Re: [rsyslog] Assign variable from expression replacement

[David Lang]

On Fri, 14 Oct 2016, Rainer Gerhards wrote:


2016-10-14 15:12 GMT+02:00 Angel L. Mateo :

Hello,

I'm trying to assign a variable with a substring of the message.
This is my config:

set $!myvar = "%msg:R,ERE,1,DFLT:^ *([a-zA-Z]+)(--end%";


This is not a valid expression, but rather a string template.

You can use e.g. the re_extract() function. Or -much less performat-
use a template and execute it.


what's the performance of calling a small mmnormalize ruleset compared to 
executing a template?


David Lang
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Assign variable from expression replacement

[Rainer Gerhards]

2016-10-14 15:12 GMT+02:00 Angel L. Mateo :
> Hello,
>
> I'm trying to assign a variable with a substring of the message.
> This is my config:
>
> set $!myvar = "%msg:R,ERE,1,DFLT:^ *([a-zA-Z]+)(--end%";

This is not a valid expression, but rather a string template.

You can use e.g. the re_extract() function. Or -much less performat-
use a template and execute it.

Doc:
http://www.rsyslog.com/doc/rainerscript.html

HTH
Rainer
>
> but when I write it with a template, I'm getting the %msg...--end%
> string instead of the substring extracted with the regular expression.
>
> Is this possible? What am I doing wrong?
>
> --
> Angel L. Mateo Martínez
> Sección de Telemática
> Área de Tecnologías de la Información
> y las Comunicaciones Aplicadas (ATICA)
> http://www.um.es/atica
> Tfo: 868889150
> Fax: 86337
> ___
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.