<div>
It doesn't seem to but perhaps I'm not doing it right. Suggestions? Documentation?
</div><div><br></div><div>-Joe</div><div><br></div>
<div><div><br></div>-- <br><div style="font-size: 13px; ">Name: Joseph A. Williams</div><div style="font-size: 13px; ">Email: williams.joe@gmail.com</div><div><br></div></div>
<p style="color: #A0A0A8;">On Wednesday, December 21, 2011 at 11:42 AM, Rainer Gerhards wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div>I'd say yes, but i guess it doesn't work for you?</div><div><br></div><div>Rainer</div><div><br></div><div>Joe Williams <<a href="mailto:williams.joe@gmail.com">williams.joe@gmail.com</a>> hat geschrieben:Is it possible to do this? </div><div><br></div><div><br></div><div>-- </div><div>Name: Joseph A. Williams</div><div>Email: <a href="mailto:williams.joe@gmail.com">williams.joe@gmail.com</a></div><div><br></div><div><br></div><div>On Monday, December 12, 2011 at 3:03 PM, Joe Williams wrote:</div><div><br></div><blockquote type="cite"><div><div>I have two rules like the following: </div><div><br></div><div>rule=:%date:date-rfc3164% %hostname:word% %process_name:char-to:\x5b%[%pid:char-to:\x5d\x3a%]: %endpoint:word% v1 %success:word% "%id:char-to:\x22%" "%org:char-to:\x22%"</div><div><br></div><div>rule=:%date:date-rfc3164% %hostname:word% %process_name:char-to:\x5b%[%pid:char-to:\x5d\x3a%]: %endpoint:word% v2 %success:word% "%id:char-to:\x22%" "%email:char-to:\x22%" </div><div><br></div><div>Note that the first one contains a literal "v1" and the last two fields are id and org and the second rule has the literal "v2" and id and email as the last two fields. The version number is the only way to determine which rule to use for any log line. Is it possible to base the rule off of the version literal but also have it in the json output that results from the rule?</div><div><br></div><div>Thanks.</div><div><br></div><div>-Joe</div><div><br></div><div><br></div><div>-- </div><div>Name: Joseph A. Williams</div><div>Email: williams.joe@gmail.com (<a href="mailto:williams.joe@gmail.com">mailto:williams.joe@gmail.com</a>)</div></div></blockquote><div><br></div><div>_______________________________________________</div><div>Lognorm mailing list</div><div><a href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a></div><div><a href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>