so In this case would the following line work to compound the statement? if $fromhost=="myhost" and $rawmsg contains "192.169.100.48" ~
Robert On Tue, Apr 1, 2014 at 6:46 PM, David Lang <[email protected]> wrote: > No, you can't use the > :var, condition, string > > type of syntax with and/or > > you have to use the if..then type of filters. > > David Lang > > On Tue, 1 Apr 2014, robert s wrote: > >> Date: Tue, 1 Apr 2014 17:09:50 -0400 >> From: robert s <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: [rsyslog] multiple filters >> >> >> Hello Guys, >> >> Hope all is well, it seems that the website revamping project is going >> fantastic, really like the new layout, and finding things are much >> easier to get to, so kudos >> >> In the documentation I have been looking for adding more statements to >> filters like "and "or" >> >> on the filter page there's some useful info regarding this, and I am >> curious with the new syntax if my example below would be correct? >> >> $msg startswith 'GenericLog' and ($msg contains '192.168.100.49' ~ >> >> so I am curious if the way I written below would be the way to write it? >> >> :rawmsg, startswith, "GenericLog#" and (rawmsg, contains, >> "192.168.100.49") ~ >> >> and the ~ still discards the message ? >> >> Thanks in advance >> >> Robert >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
