<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="Times New Roman, Times, serif">Hi list,<br>
<br>
so, I am new to syslog-ng and I am struggling with the features
regexp/store-matches and csv-parser macros. I searched the web and
mailinglist archive for these two subjects, but that didn't answer
my questions. The syslog-ng 3.1.3 I'm using is running on Debian
Squeeze.<br>
<br>
filter f_mytest {<br>
facility(local0) and<br>
level(debug) and<br>
match("^www" value("MSGHDR") flags("store-matches"));<br>
};<br>
<br>
template t_mytest {<br>
template("${MSG}--${1}\n");<br>
}<br>
<br>
destination d_mytest {<br>
file("/var/tmp/mytest.log");<br>
};<br>
<br>
log {<br>
source(s_src);<br>
filter(f_mytest);<br>
template(t_mytest);<br>
destination(f_mytest);<br>
};<br>
<br>
<br>
When I send a message to syslog-ng with: logger -p local0.debug -t
www testmessage<br>
nothing appears in the logfile. However, when
flags("store-matches") is omitted, the message appears like
expected. Why does this filter not work?<br>
<br>
<br>
I am playing around with the csv-parser function as well. The
(user-defined) macros can be used in file() functions, but I found
out that they don't work in owner() and group() functions. Is that
expected?<br>
<br>
Thanks,<br>
Remy<br>
</font>
</body>
</html>