<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi, <br>
<br>
I have an application that log date in every rows. The problem is
that the string isn't in specific part of MESSAGE, but it could be
the first element or the last element, or in the middle :-) :-) <br>
<br>
For example (only MESSAGE):<br>
User: <a class="moz-txt-link-abbreviated" href="mailto:user1@example.com">user1@example.com</a> <b>Date: 12/12/2014</b> Status: OK <br>
User: <a class="moz-txt-link-abbreviated" href="mailto:user2@example.com">user2@example.com</a> ID: 1234 Status: DEL ....... <b>Date:
03/05/2014<br>
Date: 05/08/2015 </b>User:<b> </b><a class="moz-txt-link-abbreviated" href="mailto:user3@example.com">user3@example.com</a> .......
Stauts: OK<b><br>
</b>.........<br>
<br>
I want split the log in more files arranged in different path
builded by the date information, for example
/LOGS/YYYY/MM/DD/mylog.log.<br>
<br>
I do:<br>
<title>Konsole output</title>
<div>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">rewrite
r_rewrite_set {
</span><br>
set(<span style="color:#b21818;background-color:#ffffff;">"$(python
get_data)"</span><span
style="color:#000000;background-color:#ffffff;">, value(</span><span
style="color:#b21818;background-color:#ffffff;">"APP.DATE"</span><span
style="color:#000000;background-color:#ffffff;">));
</span><br>
};
<br>
<br>
python{
<br>
import re
<br>
def get_data(logmsg):
<br>
out=None
<br>
vars(logmsg)
<br>
out = re.findall(<span
style="color:#b21818;background-color:#ffffff;">" Date:
(\d\d/\d\d/\d\d\d\d) "</span><span
style="color:#000000;background-color:#ffffff;">,
logmsg.MESSAGE)
</span><br>
if len(out) == 1:
<br>
return out[0]
<br>
else:
<br>
raise Exception(<span
style="color:#b21818;background-color:#ffffff;">"Invalid
match"</span><span
style="color:#000000;background-color:#ffffff;">)
</span><br>
};<br>
<br>
</span></div>
<meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-15">
In this way i have in APP.DATE the date.<br>
Now i have a some questions:<br>
1) Is there another way to do this without python?<br>
2) In this way for every message, syslog-ng forks and exec a python
interpreter?<br>
3) Is there a way to add custom SDATA field from python? Or is there
a way to create APP.DATE from python without rewrite rule?<br>
4) Is there a documentation about python{}? I only found a post in a
blog.<br>
<br>
Thanks<br>
<div class="moz-signature"><br>
</div>
</body>
</html>