<div dir="ltr"><div>Here is an example for using the inlist filter together with the patterndb parser: <a href="https://czanik.blogs.balabit.com/2013/09/black-cat-white-cat/">https://czanik.blogs.balabit.com/2013/09/black-cat-white-cat/</a> In this case patterndb extract IP addresses from log messages which are checked using the inlist filter.<br><br></div>Bye,<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>Balabit / syslog-ng upstream<br><a href="https://www.balabit.com/blog/author/peterczanik/" target="_blank">https://www.balabit.com/blog/author/peterczanik/</a><br><a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div></div></div></div>
<br><div class="gmail_quote">On Wed, Oct 4, 2017 at 8:14 AM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Tue, Oct 03, 2017 at 04:10:39PM -0400, Gopi Joshi wrote:<br>
> I am trying to filter messages matching text stored in a txt file (plain<br>
> txt , exact match , one word each line). but its not working<br>
<br>
</span>As Péter suggested, you should first extract the username from the MESSAGE,<br>
for instance using one of the parsers (kv, csv, db, …), and then apply the<br>
in-list filter to that extracted macro<br>
<br>
Cheers<br>
<div class="HOEnZb"><div class="h5"><br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div>