On Wed, 27 Mar 2013, Rainer Gerhards wrote:
On Wed, 2013-03-27 at 07:38 +0000, Rainer Gerhards wrote:
On Tue, 2013-03-26 at 12:26 -0700, Gary Foster wrote:
FWIW it does work properly *inside* a template.
That was the misunderstanding. These are *template* constructs, so they
are not supposed to work anywhere else. As you posted the example in
your initial mail and said you had this in the template, I assume that
this was the actual excerpt from your template.
As I wrote, there currently is no regex extraction function in
RainerScript. I could probably add one relatively quickly, but that
would be of "fire and forget" type - I mean you would not be able to
save submatches for later reuse or such. In other words: the performance
would be far from being great for at least some use cases.
I would envision something along the lines of
set $!var = regex_extract($msg, "regex-here", submatch-to-use)
where submatch-to-use would be 0 to get the full match.
Would that help?
In any case, this sounded useful for a couple of cases and as I had some
time left, I have something implemented along these lines:
http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=1b2f93da31d0331244aa7c72068f4ec324e2cb71
(sparse) doc is here - search for "re_extract" on the page:
http://www.rsyslog.com/doc/rainerscript.html
Will be released as part of 7.3.10.
I think it's just find not to have it save submatches for later use. If you need
to save a submatch, you set a variable.
A possible future enhancement would be to be able to set an array, or a list
(perl style) so that you could save all the submatches with one regex execution.
in case I'm not clear, the perl-style list would be something like
set ($!var1,$!var2) = regex_extract($msg, "regex-here")
with the first submatch going in $!var1, the second in $var2
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
