7.4.4 --James
-- sent from mobile -- ----- Reply message ----- From: "Rainer Gerhards" <[email protected]> To: "rsyslog-users" <[email protected]> Subject: [rsyslog] Local Variables Usage Question Date: Wed, Sep 18, 2013 2:45 pm Which rsyslog version? Sent from phone, thus brief. Am 18.09.2013 21:38 schrieb "Boylan, James" <[email protected]>: > That would be great. > > Now that you have pointed it out I suspect it is the function re_extract(). > > However I can't seem to get it to be happy with what I'm placing into it. > > set $.errorlevel = re_extract($msg, > "^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)",1,0); > > results with: > > Next token is token SET () > Shifting token SET () > Entering state 8 > Reading a token: 2942.763234538:7f8d47254740: Called LogError, msg: error > during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before > line 36: invalid character '$' in expression - is there an invalid escape > sequence somewhere? > rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, > on or before line 36: invalid character '$' in expression - is there an > invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] > 2942.763249065:7f8d47254740: Called LogError, msg: error during parsing > file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid > character '.' in expression - is there an invalid escape sequence somewhere? > rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, > on or before line 36: invalid character '.' in expression - is there an > invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] > Next token is token FUNC () > 2942.763276314:7f8d47254740: Called LogError, msg: error during parsing > file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: syntax > error on token 'errorlevel' > rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, > on or before line 36: syntax error on token 'errorlevel' [try > http://www.rsyslog.com/e/2207 ] > Error: popping token SET () > Stack now 0 1 > Error: popping nterm conf () > Stack now 0 > Cleanup: discarding lookahead token FUNC () > Stack now 0 > 2942.763322066:7f8d47254740: Called LogError, msg: CONFIG ERROR: could not > interpret master config file '/etc/rsyslog.d/rsyslog-port21516.conf'. > rsyslogd: CONFIG ERROR: could not interpret master config file > '/etc/rsyslog.d/rsyslog-port21516.conf'. [try > http://www.rsyslog.com/e/2207 ] > 2942.763336393:7f8d47254740: GenerateLocalHostName uses 'xxxxxx' > rsyslogd: run failed with error -2207 (see rsyslog.h or try > http://www.rsyslog.com/e/2207 to learn what that number means) > > James T. Boylan > Senior Systems Engineer * Orbitz Worldwide > 500 W. Madison St. * Suite 1000 * Chicago, IL 60661 > Office: 312-260-2378 * Mobile: 312-863-9134 > > This email and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the system manager. > This message contains confidential information and is intended only for the > individual named. If you are not the named addressee you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately by e-mail if you have received this e-mail by mistake and > delete this e-mail from your system. If you are not the intended recipient > you are notified that disclosing, copying, distributing or taking any > action in reliance on the contents of this information is strictly > prohibited. > > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Rainer Gerhards > Sent: Wednesday, September 18, 2013 2:13 PM > To: rsyslog-users > Subject: Re: [rsyslog] Local Variables Usage Question > > No, but you can't use string property syntax in scripts. Its > > Set $.var = func($msg,...); > > I am not sure if there currently is a regex function, but think so. Can > check tomorrow when I am at a real machine. > > Sent from phone, thus brief. > Am 18.09.2013 20:52 schrieb "Boylan, James" <[email protected]>: > > > Ahh. I have to convert completely over to the new config structure to > > use variables? > > > > That explains the issue. > > > > -- James > > > > > > -----Original Message----- > > From: [email protected] [mailto: > > [email protected]] On Behalf Of Rainer Gerhards > > Sent: Wednesday, September 18, 2013 1:49 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] Local Variables Usage Question > > > > You are mixing string template with script syntax! > > > > Sent from phone, thus brief. > > Am 18.09.2013 19:44 schrieb "Boylan, James" <[email protected]>: > > > > > I'm attempting to use local variables as a means to reduce the > > > overall impact of the regex per message. However I seem to be > > > running into a hurdle that I can find any documentation on. > > > > > > Specifically I'm attempting to use: > > > set $.errorlevel = > > > %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; > > > set $.session = > > > %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+) > > > \| > > > ([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9. > > > _- > > > ]*)\|(.*)--end%; > > > set $.appname = > > > %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > > set $.appversion = > > > %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > > set $.appinstance = > > > %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > > > set $,logtype = > > > %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 > > > .] > > > +)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; > > > set $.cleanmessage = > > > %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9. > > > _]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; > > > > > > Which results in: > > > Starting system logger: rsyslogd: run failed with error -2207 (see > > > rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that > > > number > > > means) > > > > > > I know it must be something in how I'm trying to define these. > > > However I haven't been able to find a definitive document on using > > > them to truly clarify it. > > > > > > Does anyone have any suggestions? > > > > > > Thanks! > > > > > > --James > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > > > you DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
