[rsyslog-notify] Forum Thread: Re: Rsyslog 5.8.10 Dynamic Filename Regex Capabilities - (Mode 'reply')

[noreply at adiscon.com]

User: rjar 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24149#p24149

Message: 
----------
Thanks the regex page was a great help however this now poses another
problem for me.  I use the following:

$template userFilePath,"userlog_%msg:R,ERE,1,DFLT:\[(.*)\]--end%"
local2.*      ?userFilePath

However this leaves me with files like the following:

userlog_admin
userlog_user1
userlog_**NO MATCH**?

So that "userlog_**NO MATCH**?" file ends up becoming a dumping ground for
anything that does not match. To guard against this do I have to run
through the regex twice ie:

$template userFilePath,"userlog_%msg:R,ERE,1,DFLT:\[(.*)\]--end%"
:msg, regex, "\[(.*)\]" ?userFilePath

Or am I completely off base here?