Hi,
I'd like to drop message if they contains a few keywords.
The logic looks like so: (A)
if $syslogtag contains '/usr/local/bin/node' and $msg contains '[info]' and
$msg contains 'foo' then ~
if $syslogtag contains '/usr/local/bin/node' and $msg contains '[info]' and
$msg contains 'bar' then ~
if $syslogtag contains '/usr/local/bin/node' and $msg contains '[info]' and
$msg contains 'baz' then ~
This works fine but is inefficient. I tried to rewrite as: (B)
if $syslogtag contains '/usr/local/bin/node' and $msg contains '[info]' then
{
if $msg contains 'foo' then ~
else if $msg contains 'bar' then ~
else if $msg contains 'baz' then ~
}
but this failed with " warning: selector line without actions will be
discarded"
I could instead use: (C)
if $syslogtag contains '/usr/local/bin/node' and $msg contains '[info]' and
$msg contains ('foo' or 'bar' or 'baz') then ~
but it's not as readable.
Could you please explain what I'm missing with B.?
thank you,
John
--
View this message in context:
http://rsyslog-rsyslog-users.1305293.n2.nabble.com/IF-statement-tp7581366.html
Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
