<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I would rephrase your question:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Is there a way to extract information with regular expression out of a message without changing the given value?<br>
In short: yes, but not in one step.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">I
would do something similar to Fabien's answer, you need to copy the given value to protect it.</span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">I
was thinking on how can you save some steps, maybe with using the regex capture groups $0, $1 variables, </span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"></span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">E.g.<br>
filter { match("^[a-z]+\-([a-z]+).*$", value("HOST") flags(store-matches)); }<br>
rewrite { set("$1" value("location")); };</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></span></div>
<div style="font-size: 11pt; color: rgb(0, 0, 0);"><span style="background-color: rgb(255, 255, 255); display: inline !important;"><span style="margin: 0px; background-color: rgb(255, 255, 255); display: inline !important;">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; margin: 0px; font-size: 11pt;">
<span style="margin: 0px; background-color: rgb(255, 255, 255); display: inline !important"><span style="margin: 0px; background-color: rgb(255, 255, 255); display: inline !important">Or how to save using "<span style="margin: 0px; font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; background-color: rgb(255, 255, 255); display: inline !important">copy_of_host"
temporary variable, </span></span></span><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;">but in every case you end up with additional complexity.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; margin: 0px; font-size: 11pt;">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; margin: 0px; font-size: 11pt;">
Regards,<br>
Gabor</div>
</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Fabien Wernli <wernli@in2p3.fr><br>
<b>Sent:</b> Monday, August 5, 2019 10:12<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] Regular expressions in rewrite</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
<br>
On Fri, Aug 02, 2019 at 01:40:13PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:<br>
> Is there a way to use regular expressions when setting a value in a rewrite rule?<br>
[...]<br>
> But without changing the actual log message. The goal is to create a variable from a regular expression of the host field in the message that I can then use in a destination path.<br>
<br>
You could copy the content of HOST into another macro, then use subst on the<br>
copy:<br>
<br>
rewrite r_rewrite_set_host{<br>
set("$HOST", value("copy_of_host"));<br>
subst("^[a-z]+\-([a-z]+).*$", "$1", value("copy_of_host"));<br>
set("$copy_of_host" value("location")<br>
condition(<br>
filter(f_filter_hostnames)<br>
)<br>
);<br>
unset('copy_of_host');<br>
}<br>
<br>
Note that you could also use named matches in subst:<br>
<br>
subst("^[a-z]+\-(?<location>[a-z]+).*$", "$1", value("copy_of_host"));<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7C9ae0dd2587e04543dfe208d7197c9f22%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637005895380866512&sdata=GegzgWOACep%2B4YsTraFe%2F7MZ3%2BWNsb1x%2FHJtasU5qpc%3D&reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7C9ae0dd2587e04543dfe208d7197c9f22%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637005895380866512&sdata=GegzgWOACep%2B4YsTraFe%2F7MZ3%2BWNsb1x%2FHJtasU5qpc%3D&reserved=0</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7C9ae0dd2587e04543dfe208d7197c9f22%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637005895380866512&sdata=uIo3wnwp9BLyVWNiMK8CrveMuQkm5pihfs3wdvSOjHk%3D&reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7C9ae0dd2587e04543dfe208d7197c9f22%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637005895380866512&sdata=uIo3wnwp9BLyVWNiMK8CrveMuQkm5pihfs3wdvSOjHk%3D&reserved=0</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7C9ae0dd2587e04543dfe208d7197c9f22%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637005895380876506&sdata=u7Ol9JwXwLNuEZDmiZtE7qRZp3mix73IUBH9ORyUYII%3D&reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cgabor.nagy%40oneidentity.com%7C9ae0dd2587e04543dfe208d7197c9f22%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637005895380876506&sdata=u7Ol9JwXwLNuEZDmiZtE7qRZp3mix73IUBH9ORyUYII%3D&reserved=0</a><br>
<br>
</div>
</span></font></div>
</body>
</html>