No, but you can't use string property syntax in scripts. Its Set $.var = func($msg,...);
I am not sure if there currently is a regex function, but think so. Can check tomorrow when I am at a real machine. Sent from phone, thus brief. Am 18.09.2013 20:52 schrieb "Boylan, James" <[email protected]>: > Ahh. I have to convert completely over to the new config structure to use > variables? > > That explains the issue. > > -- James > > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Rainer Gerhards > Sent: Wednesday, September 18, 2013 1:49 PM > To: rsyslog-users > Subject: Re: [rsyslog] Local Variables Usage Question > > You are mixing string template with script syntax! > > Sent from phone, thus brief. > Am 18.09.2013 19:44 schrieb "Boylan, James" <[email protected]>: > > > I'm attempting to use local variables as a means to reduce the overall > > impact of the regex per message. However I seem to be running into a > > hurdle that I can find any documentation on. > > > > Specifically I'm attempting to use: > > set $.errorlevel = > > %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; > > set $.session = > > %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+)\| > > ([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9._- > > ]*)\|(.*)--end%; > > set $.appname = > > %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > set $.appversion = > > %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > set $.appinstance = > > %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > set $,logtype = > > %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9.] > > +)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; > > set $.cleanmessage = > > %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9. > > _]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; > > > > Which results in: > > Starting system logger: rsyslogd: run failed with error -2207 (see > > rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that > > number > > means) > > > > I know it must be something in how I'm trying to define these. However > > I haven't been able to find a definitive document on using them to > > truly clarify it. > > > > Does anyone have any suggestions? > > > > Thanks! > > > > --James > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
