<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi,<br>
<br>
You don't need to escape it, it will work as you want to use (": ").<br>
The pattern that I am using:<br>
<pattern>@NUMBER:seqno@: @ESTRING:CISCO.DATE::
@@ANYSTRING:arg2@</pattern><br>
<br>
<br>
pdbtool output:<br>
root@thor:/opt/syslog-ng# bin/pdbtool match -p
/opt/syslog-ng/var/patterndb.xml -M "20: *Feb 28 15:00:08.556 AKST:
%LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to
up"<br>
MESSAGE=20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line
protocol on Interface BVI1, changed state to up<br>
.classifier.class=system<br>
.classifier.rule_id=09944c71-95eb-4bc0-8575-936931d85713<br>
seqno=20<br>
CISCO.DATE=*Feb 28 15:00:08.556 AKST<br>
arg2=%LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed
state to up<br>
testvalue=OK<br>
<br>
and it also works with syslog-ng.<br>
<br>
<br>
Glen Johnson wrote:
<blockquote
cite="mid:k2v230137531004131016s14616425y2387446aaabd2e35@mail.gmail.com"
type="cite">
<blockquote type="cite">
<pre wrap="">you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @
Similarly, if you need to use @ in a parser, you can escape it like @@
</pre>
</blockquote>
<pre wrap=""><!---->
Tested this using pdbtool match, using several permutations. I
couldn't get a match.
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
pzolee
</pre>
</body>
</html>