<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Mark,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
You are right, <b>unset(value("copy_of_host"))</b> is the way to go. <span id="🙂">
🙂</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Regards,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Attila</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Faine, Mark R. (MSFC-IS40)[NICS] <mark.faine@nasa.gov><br>
<b>Sent:</b> Thursday, September 5, 2019 3:17 PM<br>
<b>To:</b> wernli@in2p3.fr <wernli@in2p3.fr>; Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] [EXTERNAL] Re: Regular expressions in rewrite</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
<br>
Thanks, this seems to work, though I had to change the unset to:<br>
<br>
unset(value("copy_of_host"))<br>
<br>
I can't find anything in the docs for unset without using value(). Is this correct or does it change what is being done?<br>
<br>
Thanks,<br>
-Mark<br>
<br>
<br>
-----Original Message-----<br>
From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> On Behalf Of Fabien Wernli<br>
Sent: Monday, August 5, 2019 03:12<br>
To: syslog-ng@lists.balabit.hu<br>
Subject: [EXTERNAL] Re: [syslog-ng] Regular expressions in rewrite<br>
<br>
On Fri, Aug 02, 2019 at 01:40:13PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:<br>
> Is there a way to use regular expressions when setting a value in a rewrite rule?<br>
[...]<br>
> But without changing the actual log message. The goal is to create a variable from a regular expression of the host field in the message that I can then use in a destination path.<br>
<br>
You could copy the content of HOST into another macro, then use subst on the<br>
copy:<br>
<br>
rewrite r_rewrite_set_host{<br>
set("$HOST", value("copy_of_host"));<br>
subst("^[a-z]+\-([a-z]+).*$", "$1", value("copy_of_host"));<br>
set("$copy_of_host" value("location")<br>
condition(<br>
filter(f_filter_hostnames)<br>
)<br>
);<br>
unset('copy_of_host');<br>
}<br>
<br>
Note that you could also use named matches in subst:<br>
<br>
subst("^[a-z]+\-(?<location>[a-z]+).*$", "$1", value("copy_of_host"));<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=sotKBOfA%2BKH7rCQn6g7Q9k8kbKeRysWAHXWUTpKbtwU%3D&reserved=0=">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=sotKBOfA%2BKH7rCQn6g7Q9k8kbKeRysWAHXWUTpKbtwU%3D&reserved=0=</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=ReyBNEcyBUCAOrOmw4utFVYnbTKc8aqqjXST%2FoTZIZ8%3D&reserved=0=">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=ReyBNEcyBUCAOrOmw4utFVYnbTKc8aqqjXST%2FoTZIZ8%3D&reserved=0=</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=%2BJNBJmGRhREZfQk8FEMJT7AMR71LXwcZzEUXbCidVB0%3D&reserved=0=">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=%2BJNBJmGRhREZfQk8FEMJT7AMR71LXwcZzEUXbCidVB0%3D&reserved=0=</a><br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=sotKBOfA%2BKH7rCQn6g7Q9k8kbKeRysWAHXWUTpKbtwU%3D&reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=sotKBOfA%2BKH7rCQn6g7Q9k8kbKeRysWAHXWUTpKbtwU%3D&reserved=0</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=ReyBNEcyBUCAOrOmw4utFVYnbTKc8aqqjXST%2FoTZIZ8%3D&reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=ReyBNEcyBUCAOrOmw4utFVYnbTKc8aqqjXST%2FoTZIZ8%3D&reserved=0</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=%2BJNBJmGRhREZfQk8FEMJT7AMR71LXwcZzEUXbCidVB0%3D&reserved=0">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cattila.szakacs%40oneidentity.com%7C606d92cc831042c4c0e608d73203713c%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637032862689057245&sdata=%2BJNBJmGRhREZfQk8FEMJT7AMR71LXwcZzEUXbCidVB0%3D&reserved=0</a><br>
<br>
</div>
</span></font></div>
</body>
</html>