On Wed, Nov 21, 2018 at 1:55 PM Rainer Gerhards <[email protected]> wrote:
> Am Mi., 21. Nov. 2018, 20:44 hat Mike Schleif < > [email protected]> > geschrieben: > > > On Wed, Nov 21, 2018 at 12:01 PM Rainer Gerhards < > [email protected] > > > > > wrote: > > > > > El mié., 21 nov. 2018 a las 16:23, Mike Schleif > > > (<[email protected]>) escribió: > > > > Now, how can I send all log entries containing a fixed string to a > new > > > > logfile? > > > > > > https://www.rsyslog.com/doc/v8-stable/configuration/filters.html > > > > > > How to configure _actions_ with Property-Based Filters? > > You can only configure actions with filters. For all other objects it makes > no sense. > Yes, I understand that. However, are _Property-Based Filters_ filters, or something not filters? I have configured this Expression-Based Filter: if $msg contains 'The error statement was: insert into SystemEvents' then /var/log/errInsertSystemEvents.log But, first, I was stuck configuring thus: :msg,contains,"The error statement was: insert into SystemEvents" ??? I saw this example: :msg, contains, "informational" ~ The tilde is _not_ documented, except anecdotally. I wonder if there are other possibilities for that ~ position? ~ Mike _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
