>> What I had in mind was something like: >> >> if $msg matches '[someflag:(\d+)]' then "/var/log/flagged-$1.log" > > I think you'd do that right in a template: > > $template FlaggedMsgLog, > "/var/log/flagged-%msg:R,ERE,1,ZERO:\[someflag:([0-9]+)\]--end%.log" > > And then an action would be something like: > > if msg contains '[someflag:' then ?FlaggedMsgLog This does *exactly* what I want. Thank you!
> Double-check your expressions with the regex checker page (a serious help in > my own configs) at: http://www.rsyslog.com/regex/ And this is really cool too :) -Ryan Kelly _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
