[rsyslog-notify] Forum Thread: Property Replacer to change text in msg? - (Mode 'post')

[noreply at adiscon.com]

User: tk421storm 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25311#p25311

Message: 
----------
Hello all -

I'm having a heck of a time making sense of the property replacer template.
I want rsyslog to filter incoming messages, look for hardware addresses (I
can make a new template rule for each known address) and replace them with
human-friendly names for known machines. That way, if I get strange dhcp
reservations I can immediately know which are known machines and which
aren't.

I've gotten as far as selecting for a specific MAC address (i hate hate
HATE regexp) but now I can't seem to figure out how to do anything to it
other than replace the whole string with a pre-programmed property like
$date. Right now my template looks like this:

$Template tpl,"%msg:R,ERE,0,BLANK:(\W|^)b8:e8:56:bf:ab:07(\W|$)--end%\n"

I'm sure that's missing a lot, but it's all I've been able to coble
together using the online documentation and many google searches. I can see
that it's selecting the text I want it to, but then how do I tell it what
to replace that text with?

Thanks so much!

-Mike