Hello Experts,

Any help on my query about regular expression in rsyslog. The code below is not 
stripping off the <filename>.cpp from syslog.

if ( $syslogseverity-text != 'debug')
then
{
        if re_match($msg, "[a-zA-Z0-9]+\\.cpp:[0-9]+")
        then
        {
            set $!ext = re_extract($msg,"([a-zA-Z0-9]+\\.cpp:[0-9]+)",0,1,"");
            set $!msg= replace($msg, $!ext, "xxxx");
            :omfile:$testlog;FileFormat
        }
        else
            set $!msg = $msg;
 }

In Anticipation,
Warm Regards
Lak.

________________________________
From: rsyslog <rsyslog-boun...@lists.adiscon.com> on behalf of putcha narayana 
via rsyslog <rsyslog@lists.adiscon.com>
Sent: Thursday, February 22, 2018 11:20 AM
To: putcha narayana via rsyslog
Cc: putcha narayana
Subject: Re: [rsyslog] regex when used in conf files is giving hard-time

Hi,

I got the error out of the way \ had to be escaped. But the output in syslog 
file is still having <filename>.cpp. https://lists.gt.net/rsyslog/users/9264  
discussed this topic extensively. Not sure what's the final conclusion. 
Appreciate if some can handhold me now to meet the objective.

Working Sample:
if ( $syslogseverity-text != 'debug')
then
{
        if re_match($msg, "[a-zA-Z0-9]+\\.cpp:[0-9]+")
        then
        {
            set $!ext = re_extract($msg,"([a-zA-Z0-9]+\\.cpp:[0-9]+)",0,1,"");
            set $!msg= replace($msg, $!ext, "xxxx");
            :omfile:$testlog;FileFormat
        }
        else
            set $!msg = $msg;
 }

________________________________
From: rsyslog <rsyslog-boun...@lists.adiscon.com> on behalf of putcha narayana 
via rsyslog <rsyslog@lists.adiscon.com>
Sent: Thursday, February 22, 2018 10:50 AM
To: putcha narayana via rsyslog
Cc: putcha narayana
Subject: Re: [rsyslog] regex when used in conf files is giving hard-time

Minor correction:


:omfile:$testlog:FileFormat

updated as :omfile:$testlog;FileFormat


issue is not with this line though. just corrected the typo.


Lak.

________________________________
From: rsyslog <rsyslog-boun...@lists.adiscon.com> on behalf of putcha narayana 
via rsyslog <rsyslog@lists.adiscon.com>
Sent: Thursday, February 22, 2018 10:28 AM
To: rsyslog@lists.adiscon.com
Cc: putcha narayana
Subject: [rsyslog] regex when used in conf files is giving hard-time

Hi,

rsyslog version: 8.26.0

Objective: Replace <filename>.cpp:<linenumber> with "XXXX"
re_match, re_extract are throwing error when i use them in conf files.

Code Sample:
if ( $syslogseverity-text != 'debug')
then
{
        if re_match($msg, "[a-zA-Z0-9]+\.cpp:[0-9]+")
        then
        {
            set $!ext = re_extract($msg,"([a-zA-Z0-9]+\.cpp:[0-9]+)",0,1,"");
            set $!msg= replace($msg, $!ext, "xxxx");
            :omfile:$testlog:FileFormat
        }
        else
            set $!msg = $msg;
stop
}


I get the following errors:

invalid character '"' in expression

 syntax error on token 'a' [v8.26.0 try http://www.rsyslog.com/e/2207 ]


What i have tried so far:

1) I tried changing " with ' but that too returned an error at same line.


2) I tested the regex using http://www.rsyslog.com/regex/. The magic worked and 
extracted "myTestCode.cpp:46" from the below input.

 2018-02-22 09-05-01-029753:INFO:myTestCode.cpp:46:


A working sample would be a blessing. Any prior discussion on this topic will 
be handy too.

Observation:
Documentation has examples for replace, wrap. But none for re_match, re_extract.
http://www.rsyslog.com/doc/master/rainerscript/functions.html


Appreciate your help.
Thanks in advance,

Lak.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to