On Thu, 31 Jan 2013 16:58:36 +0000 Rainer Gerhards <[email protected]> wrote:
> > If you look at the http.usec and http.vhost fields in the template, is > > there a way I can have a single regex with submatch 2 going in to > > http.usec and submatch 1 going in to http.vhost? > > And submatch 3,4,5,6 etc going into their own fields in the JSON output > > of the template? > > Unfortunately, this is currently not possible. It is also surprisingly hard > to add this quickly. The reason is that the property replacer works on a > property-by-property basis, so it is unable to see any previous regex. Of > course, that can be changed, but it's not trivial. > > I also plan - but med-term - to add regex extraction functions to the script > language. Then these can do that task. > > Sorry I have no better answer. > > Rainer Hi Rainer That's no problem! I just wanted to check I wasn't missing it in the docs. I think I might actually just change my Apache log format to have a consistent delimiter and then use "extraction on fields" for most of the fields, since that should be much faster. And I'll be changing my Apache log formats anyway. But another question about field extraction... is it possible to have a complex delimiter, consisting of multiple ASCII codes, to lessen the chance of the delimiter appearing in the data. So have the delimiter as underscore comma underscore or something? Cheers, Ben _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
