<div dir="ltr">Balazs,<div><br></div><div>Something like that?</div><div><br></div><div><div>set("$(/ $R_MIN 5)", value("min_slice"));</div><div>set("$(* $min_slice 5)", value("min_slice"));</div><div>set("0${min_slice}", value("min_slice"), condition("min_slice" < "10")); # pad the "0"</div></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
<br><div class="gmail_quote">On Wed, May 10, 2017 at 7:50 PM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Balazs,<div><br></div><div>Sorry, But I didn't get your suggestion as well. do you mind to be more clearly?</div></div><div class="gmail_extra"><br clear="all"><div><div class="m_2688393072116769416gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div><div><div class="h5">
<br><div class="gmail_quote">On Wed, May 10, 2017 at 3:42 AM, Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">I think we have a $(/ $R_MIN 5) template function for integer division, likewise we have multiplication as well, which you can use to achieve the same a lot easier.</div><div class="m_2688393072116769416HOEnZb"><div class="m_2688393072116769416h5"><div class="gmail_extra"><br><div class="gmail_quote">On May 9, 2017 19:41, "Jorge Pereira" <<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">My approach is:<div><br></div><div><div> rewrite {</div><div> # e.g: 20170417/1000PM</div><div> set("00", value("min_slice"), condition("$R_MIN" >= "0"));</div><div> set("05", value("min_slice"), condition("$R_MIN" >= "5"));</div><div> set("10", value("min_slice"), condition("$R_MIN" >= "10"));</div><div> set("15", value("min_slice"), condition("$R_MIN" >= "15"));</div><div> set("20", value("min_slice"), condition("$R_MIN" >= "20"));</div><div> set("25", value("min_slice"), condition("$R_MIN" >= "25"));</div><div> set("30", value("min_slice"), condition("$R_MIN" >= "30"));</div><div> set("35", value("min_slice"), condition("$R_MIN" >= "35"));</div><div> set("40", value("min_slice"), condition("$R_MIN" >= "40"));</div><div> set("45", value("min_slice"), condition("$R_MIN" >= "45"));</div><div> set("50", value("min_slice"), condition("$R_MIN" >= "50"));</div><div> set("55", value("min_slice"), condition("$R_MIN" >= "55"));</div><div><br></div><div> # final macro</div><div> set("${YEAR}${MONTH}${DAY}-${H<wbr>OUR12}${min_slice}${AMPM}", value("logfmt_file"));</div><div> set("${YEAR}${MONTH}${DAY}/${H<wbr>OUR12}${min_slice}${AMPM}", value("logfmt_dir"));</div><div> };</div></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
<br><div class="gmail_quote">On Tue, May 9, 2017 at 4:00 AM, James Elstone <span dir="ltr"><<a href="mailto:james@elstone.net" target="_blank">james@elstone.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Hi,<br>
<br>
Are multiple channel{} commands processed in parallel or sequentially?<br>
<br>
Kr,<br>
<br>
James<div><div class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177h5"><br><br><div class="gmail_quote">On 9 May 2017 07:20:05 BST, "Scheidler, Balázs" <<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>> wrote:<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="auto">This is possible, but with quite ugly syntax. I always wanted to add some syntactic sugar, but never got around to do it.<div dir="auto"><br></div><div dir="auto">It looks like this:</div><div dir="auto"><br></div><div dir="auto">junction {</div><div dir="auto"> channel {</div><div dir="auto"> # if, with conditions specified as filters</div><div dir="auto"> filter { whatever... };</div><div dir="auto"> destination { whatever };</div><div dir="auto"> flags(final);</div><div dir="auto"> };</div><div dir="auto"> channel {</div><div dir="auto"> # else, you can add filters as well</div><div dir="auto"> destination { something else };</div><div dir="auto"> flags(final);</div><div dir="auto"> };</div><div dir="auto">};</div><div dir="auto"><br></div><div dir="auto">The key parts:</div><div dir="auto">* This can be embedded to any log statement as it is</div><div dir="auto">* It uses inline filters and destinations, but you can use other definitions by using simple parens instead of braces.</div><div dir="auto">* flags final which causes processing to be stopped at the first match. Without that, you'd be duplicating messages, if the conditions overlap.</div><div dir="auto">* You can add any number of channels, you are not limited to one if/else construct. It is more like a filter based switch with multple potential branches.</div><div dir="auto"><br></div><div dir="auto">Hope this helps,</div><div dir="auto"><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On May 9, 2017 01:03, "Jorge Pereira" <<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Ops! The documentation explaining only to use with templates.<div><br></div><div>Basically, I am looking for how to do the below pseudo-code.</div><div><br></div><div><div> destination {</div><div> if ($R_MIN >= 0 && $R_MIN < 30)</div><div> file("/path/file_00m-15m.log")<wbr>;</div><div> else</div><div> file("/path/file_30m-60m.log")<wbr>;</div><div> endif() </div><div> };</div></div><div><br></div><div>p.s: I need to save the logs in chunks of 30 minutes being 00m-30m & 31m-60m</div></div><div class="gmail_extra"><br clear="all"><div><div class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177m_-7115772265026797109m_1448828263015663302gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
<br><div class="gmail_quote">On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">never mind, I found it.<div><br></div><div><a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html" target="_blank">https://www.balabit.com/docume<wbr>nts/syslog-ng-ose-latest-guide<wbr>s/en/syslog-ng-ose-guide-admin<wbr>/html/reference-template-funct<wbr>ions.html</a><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177m_-7115772265026797109m_1448828263015663302m_-8396163469111891983gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div><div><div class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177m_-7115772265026797109m_1448828263015663302h5">
<br><div class="gmail_quote">On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">hi team,<div>is it possible to use if() ... else statements on syslog-ng 3.7? I am trying to do something like.</div><div><br></div><div>if ($value >= X)</div><div> ......</div><div>else</div><div> ......<br clear="all"><div><div class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177m_-7115772265026797109m_1448828263015663302m_-8396163469111891983m_-8682067114702254480gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
</div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div></div>
</blockquote></div><br></div></div><span class="m_2688393072116769416m_-5174310005151696230m_6441571941568020177HOEnZb"><font color="#888888">
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</font></span></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div></div>
</div></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></div></div>
</blockquote></div><br></div>