On Thu, Sep 19, 2013 at 3:00 PM, Boylan, James <[email protected]>wrote:
> Interesting. > > 5432.930238294:7fb519873740: SET $!logtype = > 5432.930240993:7fb519873740: function 're_extract' (id:8, params:5) > 5432.930248315:7fb519873740: var '$msg' > 5432.930254522:7fb519873740: string > '^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9.]+)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])' > 5432.930262987:7fb519873740: 1 > 5432.930268929:7fb519873740: 0 > 5432.930274860:7fb519873740: string 'Unknown' > 5432.930282966:7fb519873740: END SET > > Does this mean it is not resolving the $msg to the string to be parsed? I > know the end result is: > > No - also I think this is output from the optimizer step, isn't it. There it tells what the ruleset looks like (note that $msg is a var-type whereas "Unknown" is a constant string. > set $!logtype = re_extract($msg, > '^([A-Za-z0-9._-]+)\\|([A-Za-z0-9._-]+)\\|([A-Za-z0-9.]+)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\\^])', > 1, 0, 'Unknown'); > > when used here: > $template > currAppLogDynFile,"/log/app-logs/%msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|.*[\^]--end%/%FROMHOST%/%$YEAR%/%$MONTH%/%$DAY%/%msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|.*[\^]--end%-%msg:R,ERE,1,DFLT:^.*\|([A-Za-z0-9._-]+)\|.*[\^]--end%-%msg:R,ERE,1,DFLT:^.*\|.*\|([A-Za-z0-9.]+)[-_]*.*[\^]--end%-%$!logtype%.log.%$HOUR%00--test" > > Results with the %$!logtype% resolving as nothing. It doesn't even > resolved to Unknown as I would have expected. > > Hard to tell without the full flow. Can you post the full debug log (e.g. via pastebin)? Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
