<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#0050d0">
<font size="-1"><font face="Helvetica, Arial, sans-serif">After messing
around with this for several days, I found the problems.<br>
1) you can not use lowercase letters in the match name<br>
2) there are reserved words where if you try to use it as the match
name, it dorks everything up (like MSGID). This one had me ripping out
my hair and pounding my head on the desk.<br>
</font></font><br>
Sent: Thursday, March 04, 2010 3:23:59 PM<br>
From: Patrick H. <a class="moz-txt-link-rfc2396E" href="mailto:syslogng@feystorm.net"><syslogng@feystorm.net></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] pcre matches
<blockquote cite="mid:4B9032FF.8060807@feystorm.net" type="cite"><font
size="-1"><font face="Helvetica, Arial, sans-serif">How do you
use pcre named pattern matches with store-matches?<br>
I've been trying to do things like<br>
<font color="#990000">message("IP: (?<ip>\S+)"
flags(store-matches) type("pcre"))</font><br>
and then insert into a database with things like <br>
<font color="#990000">values("$ip")</font> or <font color="#990000">values("$+{ip}")</font><br>
and nothing works.<br>
I cant seem to find any examples of usage through google either.<br>
</font></font>
<pre wrap="">
<hr size="4" width="90%">
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
</body>
</html>