$template ApacheAccessLogFile, "/var/log/httpd/%msg:R,ERE,1,BLANK:([a-z0-9\-\.]+) [0-9]+$--end%_access.log"
> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Ben Bradley > Sent: Monday, January 28, 2013 12:30 PM > To: [email protected] > Subject: Re: [rsyslog] Use part of incoming syslog message in an output file > name? > > On Mon, 28 Jan 2013 10:44:31 +0000 > Rainer Gerhards <[email protected]> wrote: > > > http://www.rsyslog.com/doc/property_replacer.html > > > > That's excellent. > I've got my regular expression and tested it using the regex tester... > $template tpl, "%msg:R,ERE,1,BLANK:([a-z0-9\-\.]+) [0-9]+$--end%\n" > > > How do I modify this bit of config to use it? > > $template ApacheAccessLogFile, "/var/log/httpd/%procid%_access.log" > $template ApacheAccessLogFormat, "%msg:2:$:drop-last-lf%\r\n" > > if $app-name == 'apache-access' and $syslogfacility-text == 'local0' and > $syslogseverity-text == 'info' then - > ?ApacheAccessLogFile;ApacheAccessLogFormat > > In my ApacheAccessLogFile template I'd like to use the sub-match returned > by the regex in place of the %procid% variable in the output file path. > > How do I do that? > This would be a great example and would really help me figure out how to > build more complex configurations. > > Cheers, B > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
