Yup, 7.5.3 or above: http://git.adiscon.com/?p=rsyslog.git;a=blob;f=ChangeLog;h=58051e00b403cf2f60a778d40992ff7b7019f059;hb=HEAD Sent from phone, thus brief. Am 18.09.2013 22:06 schrieb "Rainer Gerhards" <[email protected]>:
> I think local vars require 7.5 > > Sent from phone, thus brief. > Am 18.09.2013 22:04 schrieb "Boylan, James" <[email protected]>: > >> 7.4.4 >> >> --James >> >> -- sent from mobile -- >> >> ----- Reply message ----- >> From: "Rainer Gerhards" <[email protected]> >> To: "rsyslog-users" <[email protected]> >> Subject: [rsyslog] Local Variables Usage Question >> Date: Wed, Sep 18, 2013 2:45 pm >> >> >> >> Which rsyslog version? >> >> Sent from phone, thus brief. >> Am 18.09.2013 21:38 schrieb "Boylan, James" <[email protected]>: >> >> > That would be great. >> > >> > Now that you have pointed it out I suspect it is the function >> re_extract(). >> > >> > However I can't seem to get it to be happy with what I'm placing into >> it. >> > >> > set $.errorlevel = re_extract($msg, >> > "^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)",1,0); >> > >> > results with: >> > >> > Next token is token SET () >> > Shifting token SET () >> > Entering state 8 >> > Reading a token: 2942.763234538:7f8d47254740: Called LogError, msg: >> error >> > during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before >> > line 36: invalid character '$' in expression - is there an invalid >> escape >> > sequence somewhere? >> > rsyslogd: error during parsing file >> /etc/rsyslog.d/rsyslog-port21516.conf, >> > on or before line 36: invalid character '$' in expression - is there an >> > invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] >> > 2942.763249065:7f8d47254740: Called LogError, msg: error during parsing >> > file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: >> invalid >> > character '.' in expression - is there an invalid escape sequence >> somewhere? >> > rsyslogd: error during parsing file >> /etc/rsyslog.d/rsyslog-port21516.conf, >> > on or before line 36: invalid character '.' in expression - is there an >> > invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] >> > Next token is token FUNC () >> > 2942.763276314:7f8d47254740: Called LogError, msg: error during parsing >> > file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: syntax >> > error on token 'errorlevel' >> > rsyslogd: error during parsing file >> /etc/rsyslog.d/rsyslog-port21516.conf, >> > on or before line 36: syntax error on token 'errorlevel' [try >> > http://www.rsyslog.com/e/2207 ] >> > Error: popping token SET () >> > Stack now 0 1 >> > Error: popping nterm conf () >> > Stack now 0 >> > Cleanup: discarding lookahead token FUNC () >> > Stack now 0 >> > 2942.763322066:7f8d47254740: Called LogError, msg: CONFIG ERROR: could >> not >> > interpret master config file '/etc/rsyslog.d/rsyslog-port21516.conf'. >> > rsyslogd: CONFIG ERROR: could not interpret master config file >> > '/etc/rsyslog.d/rsyslog-port21516.conf'. [try >> > http://www.rsyslog.com/e/2207 ] >> > 2942.763336393:7f8d47254740: GenerateLocalHostName uses 'xxxxxx' >> > rsyslogd: run failed with error -2207 (see rsyslog.h or try >> > http://www.rsyslog.com/e/2207 to learn what that number means) >> > >> > James T. Boylan >> > Senior Systems Engineer * Orbitz Worldwide >> > 500 W. Madison St. * Suite 1000 * Chicago, IL 60661 >> > Office: 312-260-2378 * Mobile: 312-863-9134 >> > >> > This email and any files transmitted with it are confidential and >> intended >> > solely for the use of the individual or entity to whom they are >> addressed. >> > If you have received this email in error please notify the system >> manager. >> > This message contains confidential information and is intended only for >> the >> > individual named. If you are not the named addressee you should not >> > disseminate, distribute or copy this e-mail. Please notify the sender >> > immediately by e-mail if you have received this e-mail by mistake and >> > delete this e-mail from your system. If you are not the intended >> recipient >> > you are notified that disclosing, copying, distributing or taking any >> > action in reliance on the contents of this information is strictly >> > prohibited. >> > >> > >> > -----Original Message----- >> > From: [email protected] [mailto: >> > [email protected]] On Behalf Of Rainer Gerhards >> > Sent: Wednesday, September 18, 2013 2:13 PM >> > To: rsyslog-users >> > Subject: Re: [rsyslog] Local Variables Usage Question >> > >> > No, but you can't use string property syntax in scripts. Its >> > >> > Set $.var = func($msg,...); >> > >> > I am not sure if there currently is a regex function, but think so. Can >> > check tomorrow when I am at a real machine. >> > >> > Sent from phone, thus brief. >> > Am 18.09.2013 20:52 schrieb "Boylan, James" <[email protected]>: >> > >> > > Ahh. I have to convert completely over to the new config structure to >> > > use variables? >> > > >> > > That explains the issue. >> > > >> > > -- James >> > > >> > > >> > > -----Original Message----- >> > > From: [email protected] [mailto: >> > > [email protected]] On Behalf Of Rainer Gerhards >> > > Sent: Wednesday, September 18, 2013 1:49 PM >> > > To: rsyslog-users >> > > Subject: Re: [rsyslog] Local Variables Usage Question >> > > >> > > You are mixing string template with script syntax! >> > > >> > > Sent from phone, thus brief. >> > > Am 18.09.2013 19:44 schrieb "Boylan, James" <[email protected] >> >: >> > > >> > > > I'm attempting to use local variables as a means to reduce the >> > > > overall impact of the regex per message. However I seem to be >> > > > running into a hurdle that I can find any documentation on. >> > > > >> > > > Specifically I'm attempting to use: >> > > > set $.errorlevel = >> > > > %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; >> > > > set $.session = >> > > > %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+) >> > > > \| >> > > > ([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9. >> > > > _- >> > > > ]*)\|(.*)--end%; >> > > > set $.appname = >> > > > %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 >> > > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; >> > > > set $.appversion = >> > > > %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 >> > > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; >> > > > set $.appinstance = >> > > > %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 >> > > > ._ ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; >> > > > set $,logtype = >> > > > %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9 >> > > > .] >> > > > +)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; >> > > > set $.cleanmessage = >> > > > >> %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9. >> > > > _]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; >> > > > >> > > > Which results in: >> > > > Starting system logger: rsyslogd: run failed with error -2207 (see >> > > > rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that >> > > > number >> > > > means) >> > > > >> > > > I know it must be something in how I'm trying to define these. >> > > > However I haven't been able to find a definitive document on using >> > > > them to truly clarify it. >> > > > >> > > > Does anyone have any suggestions? >> > > > >> > > > Thanks! >> > > > >> > > > --James >> > > > _______________________________________________ >> > > > rsyslog mailing list >> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > > > http://www.rsyslog.com/professional-services/ >> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> > > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >> > > > you DON'T LIKE THAT. >> > > > >> > > _______________________________________________ >> > > rsyslog mailing list >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > > http://www.rsyslog.com/professional-services/ >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> WELL: >> > > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites >> > > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> > > LIKE THAT. >> > > _______________________________________________ >> > > rsyslog mailing list >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > > http://www.rsyslog.com/professional-services/ >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > > DON'T LIKE THAT. >> > > >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: >> > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites >> > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >> > THAT. >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > DON'T LIKE THAT. >> > >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
