I'm attempting to use local variables as a means to reduce the overall impact of the regex per message. However I seem to be running into a hurdle that I can find any documentation on.
Specifically I'm attempting to use: set $.errorlevel = %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; set $.session = %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+)\|([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9._-]*)\|(.*)--end%; set $.appname = %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; set $.appversion = %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; set $.appinstance = %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; set $,logtype = %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9.]+)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; set $.cleanmessage = %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; Which results in: Starting system logger: rsyslogd: run failed with error -2207 (see rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that number means) I know it must be something in how I'm trying to define these. However I haven't been able to find a definitive document on using them to truly clarify it. Does anyone have any suggestions? Thanks! --James _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
