Sorry for the mistake, i'm using rsyslogd 5.10 ( can't upgrade because using
omoracle module):
rsyslogd 5.10.0, compiled with: FEATURE_REGEXP:
Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5
support: No FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes 64bit Atomic operations
supported: Yes Runtime Instrumentation (slow code): No
Regex feature didn't see to be present in this version:
http://www.rsyslog.com/doc/v5-stable/rainerscript/functions.html?highlight=re_match
> Date: Tue, 14 Apr 2015 15:10:44 +0200
> From: [email protected]
> To: [email protected]
> Subject: Re: [rsyslog] rsyslog regex bre "or operator"
>
> 2015-04-14 15:07 GMT+02:00 gaelor couilleaux <[email protected]>:
> > I'm using:
> > rsyslogd 7.6.1, compiled with: FEATURE_REGEXP:
> > Yes FEATURE_LARGEFILE: No GSSAPI
> > Kerberos 5 support: No FEATURE_DEBUG (debug build, slow
> > code): No 32bit Atomic operations supported: Yes 64bit
> > Atomic operations supported: Yes Runtime Instrumentation (slow
> > code): No uuid support: Yes
> > Number of Bits in RainerScript integers: 64
> > Old filter format works:
> > :hostname,!regex, "^.*\.gemalto\.com$" ~:fromhost-ip,isequal,"10.54.2.98" ~
> > But new one didn't works:
> > if $fromhost-ip == '10.54.2.98' and not ($hostname regex
> > '.*\.gemalto\.com') then ~
>
> You need to use re_match for this:
>
> http://www.rsyslog.com/doc/v8-stable/rainerscript/functions.html?highlight=re_match
>
> Rainer
> >
> >> From: [email protected]
> >> To: [email protected]
> >> Date: Tue, 14 Apr 2015 14:46:34 +0200
> >> Subject: Re: [rsyslog] rsyslog regex bre "or operator"
> >>
> >> Hello,
> >> Do you have an exemple with if condition and a regex method ?
> >> I must write it like this :
> >> if $hostname !regex "^.*\.gemalto\.com$" or $hostname !regex "^dct.*$"
> >> then ~
> >> ?
> >> THX in Advanced
> >>
> >> > Date: Fri, 10 Apr 2015 05:14:48 -0700
> >> > From: [email protected]
> >> > To: [email protected]
> >> > Subject: Re: [rsyslog] rsyslog regex bre "or operator"
> >> >
> >> > On Fri, 10 Apr 2015, gaelor couilleaux wrote:
> >> >
> >> > > Hello every body,
> >> > >
> >> > > I'm trying to filter with differents patten on hostname with regex BRE
> >> > > method.
> >> > >
> >> > > I'm using http://www.rsyslog.com/regex/ tool.
> >> > >
> >> > > My problem is i have hostnames contains "gemalto.com" or "dct",
> >> > > normally the rule i would like use:
> >> > >
> >> > > :hostname,!regex, "(^.*\.gemalto\.com$)|(^dct.*$)" ~
> >> > >
> >> > > But didn't work
> >> >
> >> > test the regex here: http://www.rsyslog.com/regex/
> >> >
> >> > Also, you may have to switch to the if then type of test. On v7 and
> >> > newer it's
> >> > as fast as the other style of test and allows more complex expressions
> >> >
> >> > David Lang
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> >> > DON'T LIKE THAT.
> >>
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> >> DON'T LIKE THAT.
> >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> > LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
