[rsyslog-notify] Forum Thread: Re: Rsyslog 5.8.10 Dynamic Filename Regex Capabilities - (Mode 'reply')
noreply at adiscon.com
noreply at adiscon.com
Wed Jan 29 20:23:33 CET 2014
User: rjar
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24149#p24149
Message:
----------
Thanks the regex page was a great help however this now poses another
problem for me. I use the following:
$template userFilePath,"userlog_%msg:R,ERE,1,DFLT:\[(.*)\]--end%"
local2.* ?userFilePath
However this leaves me with files like the following:
userlog_admin
userlog_user1
userlog_**NO MATCH**?
So that "userlog_**NO MATCH**?" file ends up becoming a dumping ground for
anything that does not match. To guard against this do I have to run
through the regex twice ie:
$template userFilePath,"userlog_%msg:R,ERE,1,DFLT:\[(.*)\]--end%"
:msg, regex, "\[(.*)\]" ?userFilePath
Or am I completely off base here?
More information about the rsyslog-notify
mailing list