Sent from phone, thus brief. Am Mi., 21. Nov. 2018, 21:07 hat Mike Schleif <[email protected]> geschrieben:
> On Wed, Nov 21, 2018 at 1:55 PM Rainer Gerhards <[email protected]> > wrote: > > > Am Mi., 21. Nov. 2018, 20:44 hat Mike Schleif < > > [email protected]> > > geschrieben: > > > > > On Wed, Nov 21, 2018 at 12:01 PM Rainer Gerhards < > > [email protected] > > > > > > > wrote: > > > > > > > El mié., 21 nov. 2018 a las 16:23, Mike Schleif > > > > (<[email protected]>) escribió: > > > > > Now, how can I send all log entries containing a fixed string to a > > new > > > > > logfile? > > > > > > > > https://www.rsyslog.com/doc/v8-stable/configuration/filters.html > > > > > > > > > How to configure _actions_ with Property-Based Filters? > > > > You can only configure actions with filters. For all other objects it > makes > > no sense. > > > > Yes, I understand that. > > However, are _Property-Based Filters_ filters, or something not filters? > A filter is a filter, its just different types > > > > I have configured this Expression-Based Filter: > if $msg contains 'The error statement was: insert into SystemEvents' then > /var/log/errInsertSystemEvents.log > > But, first, I was stuck configuring thus: > :msg,contains,"The error statement was: insert into SystemEvents" ??? > > I saw this example: :msg, contains, "informational" ~ > > The tilde is _not_ documented, except anecdotally. I wonder if there are > other possibilities for that ~ position? > ~ is the old name for stop (action). So :msg, contains, "informational" /var/log/errInsertSystemEvents.log Or :msg, contains, "informational" { /var/log/errInsertSystemEvents.log Action(...) # other actions } So it's just a filter... Any filter works *.* If ... Doc PRs are welcome if the wording can be clarified. Rainer > > > ~ Mike > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
