2015-11-17 23:25 GMT+01:00 Peter Portante <[email protected]>: > Hi Folks, > > It seems that imjournal populates the systemd/journal fields defined here, > http://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html, > using the same field names as CEE properties. > > But it seems that rsyslog considers "$!_" as some kind of escape sequence, > I cannot reference a field like: > > set $.systemd!t!AUDIT_LOGINUID = $!_AUDIT_LOGINUID; > > > Is that expected? And if so, is there a way around it without requiring a > change to imjournal?
That is probably simply because the grammar does not permit "_" at the begin of a variable name. I don't remember immediately if there was a real reason for that, but I don't think so. So it's probably just a matter of changing the grammar (lexer actually). Rainer > > Thanks, > > -peter > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
