Baszi<br><br>Cool. I'm in the middle of building a new infrastructure and would like to use this feature. I'm not a programmer but I assume adding this feature shouldn't be very hard at all right ?<br>If you had a rough ETA that'd help me.
<br><br>thx<br><br><div><span class="gmail_quote">On 4/28/07, <b class="gmail_sendername">Balazs Scheidler</b> <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Sat, 2007-04-28 at 01:52 -0700, stucky wrote:<br>> Guys<br>><br>> Playing around with ng 2 and I started looking at the match filter<br>> again.<br>> Simple question that I cannot find an answer to anywhere on the net.
<br>> How do I turn off case sensitivity for the match target ?<br>> I'd like the following line to match "error' or 'ERROR' or 'Error'<br>><br>> filter logparse { match("error"); };
<br>><br>> but of course it only matches 'error' since by default regex is case<br>> sensitive.<br>> Basically I'm trying to emulate 'grep -i'<br>> I guess I could do this :<br>><br>> filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo
<br>> much simpler to turn off case sensitivity.<br><br>Yes, you are right. But it's not currently possible. It should be<br>however, I'll try to add it in the nearfuture.<br><br>><br>> And while we're talking regex. Shouldn't the above line actually read
<br>> like this :<br>><br>> filter logparse { match(".+error.+"); }; ?<br>><br>> meaning "anything followed by 'error' followed by anything"<br>> Both appear to work so I assume the first line is interpreted by
<br>> syslog-ng like the second line correct ?<br><br>syslog-ng interprets "match" the same as grep, e.g. it does not care<br>where the pattern is found. if you want to match the beginning or the<br>end of line, you need to use explicit ^ and $ characters.
<br><br>--<br>Bazsi<br><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br><br clear="all">
<br>-- <br>stucky