There may be a bug as I can't get a single or colon-escaped single colon to match, but as a workaround, this fits the bill:<br><br>@ESTRING:CISCO.DATE:: @%LINEPROTO...<br><br>Where the ESTRING match pattern is <colon><space>. It's a greedy match, so the % must immediately follow the @ because the colon and space were parsed and consumed.<br>
<br><div class="gmail_quote">On Tue, Apr 13, 2010 at 1:11 PM, Fekete Róbert <span dir="ltr"><<a href="mailto:frobert@balabit.com">frobert@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im"><br>
On Tuesday, April 13, 2010 19:16 CEST, Glen Johnson <<a href="mailto:gfjohnson@alaska.edu">gfjohnson@alaska.edu</a>> wrote:<br>
<br>
> > you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @<br>
> > Similarly, if you need to use @ in a parser, you can escape it like @@<br>
><br>
> Tested this using pdbtool match, using several permutations. I<br>
> couldn't get a match.<br>
</div>Then this looks like a bug, two independent developers stated that :: should work. I'll get someone take a closer look at it.<br>
<div><div></div><div class="h5">> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
><br>
><br>
<br>
<br>
<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</div></div></blockquote></div><br>