<div dir="ltr">Thanks Peter and Wernli.<div> <div>I am trying to use kv parser to extract username from MESSAGE template so that i can use it to compare further .</div><div><br></div><div>from below VPN logs , i am trying to extract value LOCAL\user1 and user1 (value-separator("(") pair-separator(")") </div><div><br></div><div><div>Teardown TCP connection 51507415 for outside:<a href="http://2.2.2.2/60709">2.2.2.2/60709</a><b>(LOCAL\user1l)</b> to inside:5,5,5,5/443 duration 0:00:06 bytes 0 Failover primary closed <b>(user1)</b></div></div><div><br></div><div>i donot see it maching and any value being saved to $KEY1 to refer the match , </div><div><br></div><div>Below is the conf file .</div><div><br></div><div><div>@version: 3.12</div><div>@include "scl.conf"</div><div><br></div><div>source s_local {</div><div> system();</div><div> internal();</div><div>};</div><div><br></div><div>source s_network { udp(port(514) flags(no-parse));</div><div>};</div><div><br></div><div>#### PARSER ###</div><div><br></div><div>parser p_kv { kv-parser(value-separator("(") pair-separator(")") prefix("kv."));</div><div>};</div><div>##### VPN LOG ####</div><div> </div><div>#filter f_users { in-list("/var/syslog-ng/user.list", value("${KEY1}")); }; --- Not in Use at present</div><div><br></div><div>filter f-syslog { host("1.1.1.1"); };</div><div>destination log-vpntest { file("/var/log/vpn/vpntest.log" perm(0644) template("$ISODATE $HOST ${kv.KEY1} $KEY1\n") ); };</div><div>log { source(s_network);parser(p_kv);filter(f-syslog);destination(log-vpntest); };</div><div><br></div><div>#### VPN LOG ENDS ###</div></div><div><br></div><div>Regards</div><div>Gopi Joshi</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 4, 2017 at 2:54 AM, Czanik, Péter <span dir="ltr"><<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Here is an example for using the inlist filter together with the patterndb parser: <a href="https://czanik.blogs.balabit.com/2013/09/black-cat-white-cat/" target="_blank">https://czanik.blogs.balabit.<wbr>com/2013/09/black-cat-white-<wbr>cat/</a> In this case patterndb extract IP addresses from log messages which are checked using the inlist filter.<br><br></div>Bye,<br></div><div class="gmail_extra"><br clear="all"><div><div class="m_-7679159391907468290gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peter Czanik (CzP) <<a href="mailto:peter.czanik@balabit.com" target="_blank">peter.czanik@balabit.com</a>><br>Balabit / syslog-ng upstream<br><a href="https://www.balabit.com/blog/author/peterczanik/" target="_blank">https://www.balabit.com/blog/<wbr>author/peterczanik/</a><br><a href="https://twitter.com/PCzanik" target="_blank">https://twitter.com/PCzanik</a></div></div></div></div><div><div class="h5">
<br><div class="gmail_quote">On Wed, Oct 4, 2017 at 8:14 AM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Tue, Oct 03, 2017 at 04:10:39PM -0400, Gopi Joshi wrote:<br>
> I am trying to filter messages matching text stored in a txt file (plain<br>
> txt , exact match , one word each line). but its not working<br>
<br>
</span>As Péter suggested, you should first extract the username from the MESSAGE,<br>
for instance using one of the parsers (kv, csv, db, …), and then apply the<br>
in-list filter to that extracted macro<br>
<br>
Cheers<br>
<div class="m_-7679159391907468290HOEnZb"><div class="m_-7679159391907468290h5"><br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>