The regex is potentially many times slower. Avoid it (albeit the simple regex you show may be not sooo bad).
Rainer El jue, 18 feb 2021 a las 9:11, Mariusz Kruk via rsyslog (<[email protected]>) escribió: > > A "side question" - what would be better performance-wise? > > A complex condition ($msg contains "A" or $msg contains "B") or regex > match (re_match($msg,"(A|B)")? > > It seems intuitive that simple match, even done twice (A _or_ B) shoul > be faster than regexp matching but is it indeed? > > On 18.02.2021 08:49, Rainer Gerhards via rsyslog wrote: > > if $msg contains "ERROR:" or $msg contains "FATAL:" then > > @logs6.papertrailapp.com:10000 > > > > not sure if the syntax is 100% correct, but you get the idea. > > > > HTH > > Rainer > > > > El mié, 17 feb 2021 a las 23:29, ashutosh via rsyslog > > (<[email protected]>) escribió: > >> Any help is appreciated. > >> > >> On Wed, Feb 17, 2021 at 3:17 PM ashutosh <[email protected]> wrote: > >> > >>> Hi Team, > >>> > >>> I have one question related to rsyslog filters. I need to search two > >>> keywords in my log file and send those to papertrail. Keywords are - > >>> ERROR: > >>> & FATAL: > >>> > >>> I tried something like that, but it didn't work. > >>> > >>> :msg, contains, "ERROR:" or "FATAL:" @logs6.papertrailapp.com:10000 > >>> > >>> Kindly advice. > >>> > >>> Thanks, > >>> > >>> -- > >>> > >>> Regards, > >>> Ashutosh Durugkar > >>> Database Admin Oracle & PostgreSQL. > >>> > >> > >> -- > >> > >> Regards, > >> Ashutosh Durugkar > >> Database Admin Oracle & PostgreSQL. > >> _______________________________________________ > >> rsyslog mailing list > >> https://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
