Ahh. I have to convert completely over to the new config structure to use variables?
That explains the issue. -- James -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Rainer Gerhards Sent: Wednesday, September 18, 2013 1:49 PM To: rsyslog-users Subject: Re: [rsyslog] Local Variables Usage Question You are mixing string template with script syntax! Sent from phone, thus brief. Am 18.09.2013 19:44 schrieb "Boylan, James" <[email protected]>: > I'm attempting to use local variables as a means to reduce the overall > impact of the regex per message. However I seem to be running into a > hurdle that I can find any documentation on. > > Specifically I'm attempting to use: > set $.errorlevel = > %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; > set $.session = > %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+)\| > ([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9._- > ]*)\|(.*)--end%; > set $.appname = > %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > set $.appversion = > %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > set $.appinstance = > %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > set $,logtype = > %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9.] > +)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; > set $.cleanmessage = > %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9. > _]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; > > Which results in: > Starting system logger: rsyslogd: run failed with error -2207 (see > rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that > number > means) > > I know it must be something in how I'm trying to define these. However > I haven't been able to find a definitive document on using them to > truly clarify it. > > Does anyone have any suggestions? > > Thanks! > > --James > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
