<div dir="ltr"><div dir="ltr">Hi Attila,<br><br>Thank you for reply. We are using these type of If-Else condition in patterendb xml and want to know if there is any documentation available to implement other types of conditions as well.<br><br><div style="box-sizing:border-box;font-family:Menlo,Monaco,Consolas,"Courier New",Courier,monospace;font-size:14px;white-space:pre"><pre><rules>
<rule id="xyz-3735951352" class="xyz">
<patterns>
<pattern>@ESTRING::"[@@ESTRING:tmp.day:/@@ESTRING:tmp.month:/@@ESTRING:tmp.year::@@PCRE:tmp.time:\d{1,2}:\d{1,2}:\d{1,2}@ @ESTRING:timezone:]@"@ESTRING:tmp.dstport: @</pattern>
</patterns>
<values>
<value name="metaclass">xyz</value>
<value name="dstport">$(if ("${tmp.dstport}" != "-") ${tmp.dstport} 0)</value>
<value name="requesttime">${tmp.year}-$(if ("${tmp.month}" == "Jan") 01 $(if ("${tmp.month}" == "jan") 01 $(if ("${tmp.month}" == "Feb") 02 $(if ("${tmp.month}" == "feb") 02 $(if ("${tmp.month}" == "Mar") 03 $(if ("${tmp.month}" == "mar") 03 $(if ("${tmp.month}" == "Apr") 04 $(if ("${tmp.month}" == "apr") 04 $(if ("${tmp.month}" == "May") 05 $(if ("${tmp.month}" == "may") 05 $(if ("${tmp.month}" == "Jun") 06 $(if ("${tmp.month}" == "jun") 06 $(if ("${tmp.month}" == "Jul") 07 $(if ("${tmp.month}" == "jul") 07 $(if ("${tmp.month}" == "Aug") 08 $(if ("${tmp.month}" == "aug") 08 $(if ("${tmp.month}" == "Sep") 09 $(if ("${tmp.month}" == "sep") 09 $(if ("${tmp.month}" == "Oct") 10 $(if ("${tmp.month}" == "oct") 10 $(if ("${tmp.month}" == "Nov") 11 $(if ("${tmp.month}" == "nov") 11 $(if ("${tmp.month}" == "Dec") 12 $(if ("${tmp.month}" == "dec") 12 ${tmp.month}))))))))))))))))))))))))-${tmp.day} ${tmp.time}</value>
</values> </pre></div><span style="font-family:Menlo,Monaco,Consolas,"Courier New",Courier,monospace;font-size:14px;white-space:pre"> </rule></span> </div><br>Thanks,<br>Mukesh Kumar<br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 1, 2021 at 2:06 PM Attila Szakacs (aszakacs) <<a href="mailto:Attila.Szakacs@oneidentity.com">Attila.Szakacs@oneidentity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Hi Mukesh,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
You cannot use if-else or for loop in patterndb, you can only set pattern matching rules, to classify the incoming log messages.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
The oldest Admin Guide I have found is for 3.5: <a href="https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition/3.5" id="gmail-m_5931869266015153406LPlnk776112" target="_blank">https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition/3.5</a></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Chapter 13 is about patterndb.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Can you tell us your use case? What do you want to achieve by using if-else and for loop in the patterndb xml?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Cheers,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Attila</div>
<div id="gmail-m_5931869266015153406appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_5931869266015153406divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>> on behalf of mukesh kumar <<a href="mailto:mkkumar20@gmail.com" target="_blank">mkkumar20@gmail.com</a>><br>
<b>Sent:</b> Monday, February 1, 2021 6:50 AM<br>
<b>To:</b> <a href="mailto:syslog-ng-owner@lists.balabit.hu" target="_blank">syslog-ng-owner@lists.balabit.hu</a> <<a href="mailto:syslog-ng-owner@lists.balabit.hu" target="_blank">syslog-ng-owner@lists.balabit.hu</a>>; <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> [syslog-ng] Syslog-ng 3.4.5 support question</font>
<div> </div>
</div>
<div>
<div style="background-color:rgb(255,235,156);width:100%;border-style:solid;border-color:rgb(156,101,0);border-width:1pt;padding:2pt;font-size:10pt;line-height:12pt;font-family:Calibri;color:black;text-align:left">
<span style="color:rgb(156,101,0);font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr"><span style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">Hi,</span><br style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">
<br style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">
<span style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">We are using syslog-ng 3.4.5 version and we are using it to utilize patterndb. We are not looking for bug fix but using it for just all the different
ways we can use the patterndb xml. Please provide me the info on such as the IF and ELSE statements, For loops in the xml file.</span><br style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">
<br style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">
<span style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">Thanks,</span><br style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">
<span style="font-family:"Segoe UI",system-ui,"Apple Color Emoji","Segoe UI Emoji",sans-serif;font-size:14px">Mukesh Kumar</span><br>
</div>
</div>
</div>
</div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div></div>