[rsyslog-notify] Forum Thread: Re: Help with Regex parsing - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25223#p25223

Message: 
----------
regex does one match of your pattern against the log line. It matches as
early in the message as it can, and it consumes as much of the message as
it can. So if you want to have the pattern match multiple times, you have
to repeat the pattern

You may also want to look at the mmnormalize module, it's designed to
extract data out of log lines into user-defined variables that you can then
use in your templates. It's significantly faster than even one regex, let
alone having to use the same regex multiple times to extract different
fields.