Aha! Thanks. I actually tried to use the escaping tool on the rsyslog website but just ended up with an empty page. On Sep 16, 2015 11:29 PM, "Rainer Gerhards" <[email protected]> wrote:
> You need to escape the backslashes inside the string, as such: > > '1\\.2\\.\\d+\\.\\d+' > > HTH > Rainer > > 2015-09-17 4:20 GMT+02:00 Orangepeel Beef <[email protected]>: > > A while back I asked a question and got a working response on how to do > > else if in the rsyslog.conf > > > > http://www.gossamer-threads.com/lists/rsyslog/users/9909 > > > > > > I'm trying to do something very similar again, but it's not working as > I'd > > expect it to. > > > > > > if re_match($fromhost-ip, '1\.2\.\d+\.\d+') then { > > blah blah > > } else if re_match($fromhost-ip, '2\.3\.\d+\.\d+') then { > > blah blah > > } > > > > However it isn't working, and when i ask it to check the config file with > > -N1 its saying there are invalid characters in the regex. > > > > I've tried multiple different regexes but it doesn't seem to be working. > > > > (essentially i'm trying to direct logs to different subfolders and > scripts > > based on their source ip) > > > > In the past i've done this with hostnames, but we have no reverse dns > here > > to use. > > > > Thoughts? > > > > > > invalid character ''' in expression > > syntax error on token '/' > > could not interpret master file > > > > etc.. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
