<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The square brackets are special characters in a pcre expression and need to be escaped. The other tricky thing is that pcre expressions are greedy. By that I mean that this will match the first [ and then the LAST ] so in your example the following would be
removed</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
[*09/12/2024 11:39:31.9055] bwar: [7649:I:CN_ML]</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Or more if there is another ] in the message.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The expression you are looking for is</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
subst( '^\[\*\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}\.\d+\]\s', '', type(pcre), value("MESSAGE"));</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(153, 153, 153);">
--</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(153, 153, 153);">
Evan</div>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Wilson, Jonathan L <jonathan.wilson@vumc.org><br>
<b>Sent:</b> September 12, 2024 4:49 AM<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] rewrite in syslog-ng</span>
<div> </div>
</div>
<table align="left" style="direction: ltr; text-indent: revert; line-height: revert; white-space: revert; background-color: revert; display: table; margin: revert; width: 100%; height: revert; table-layout: fixed; color: revert; border-collapse: collapse; border-spacing: 0px; box-sizing: border-box;">
<tbody>
<tr style="background-color: revert;">
<td style="direction: ltr; text-indent: revert; line-height: revert; white-space: revert; border-width: revert; border-style: revert; border-color: revert; background-color: rgb(166, 166, 166); padding: 7px 2px; word-break: revert; color: revert; width: 0px; height: revert;">
</td>
<td style="direction: ltr; text-align: left; text-indent: revert; line-height: revert; white-space: revert; border-width: revert; border-style: revert; border-color: revert; background-color: rgb(234, 234, 234); padding: 7px 5px 7px 15px; word-break: revert; color: rgb(33, 33, 33); width: 100%; height: revert;">
<div style="direction: ltr; text-align: left; text-indent: revert; line-height: revert; white-space: revert; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; color: revert;">
<span style="letter-spacing: revert; background-color: revert; line-height: revert;">You don't often get email from jonathan.wilson@vumc.org.
<a href="https://aka.ms/LearnAboutSenderIdentification" data-auth="NotApplicable" id="OWAdc4ebae7-48fc-9adb-2fb2-29f7e8822505" class="OWAAutoLink">
Learn why this is important</a></span></div>
</td>
<td align="left" style="direction: ltr; text-indent: revert; line-height: revert; white-space: revert; border-width: revert; border-style: revert; border-color: revert; background-color: rgb(234, 234, 234); padding: 7px 5px; word-break: revert; color: rgb(33, 33, 33); width: 75px; height: revert;">
</td>
</tr>
</tbody>
</table>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">Running OSE version 3.38.1 and having difficulty with a rewrite rule.</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">The logs that I’m trying to modify look like:</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in 0in 0in 0.5in; font-family: Aptos, sans-serif; font-size: 11pt;">
<span style="font-family: Consolas; font-size: 10pt;">2024-09-12T06:39:31-05:00 hostname kernel: [*09/12/2024 11:39:31.9055] bwar: [7649:I:CN_ML] …</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">What I am trying to do is remove the extra timestamp in square brackets (the first field in square brackets above.)</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">My rewrite rule looks like:</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in 0in 0in 0.5in; font-family: Aptos, sans-serif; font-size: 11pt;">
<span style="font-family: Consolas;">rewrite r_bracketed_ts {</span></p>
<p style="margin: 0in 0in 0in 0.5in; font-family: Aptos, sans-serif; font-size: 11pt;">
<span style="font-family: Consolas;"> subst( '^[.+]\s', '', type(pcre), value("MESSAGE"));</span></p>
<p style="margin: 0in 0in 0in 0.5in; font-family: Aptos, sans-serif; font-size: 11pt;">
<span style="font-family: Consolas;">};</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">It is invoked from this log statement:</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;">log {</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> source(s_BSD_UDP_514);</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> filter(f_something);</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> rewrite(r_bracketed_ts);</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> destination(d_something);</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> flags(final,flow-control);</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;">};</span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> </span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"><span style="font-family: Consolas; font-size: 10pt;"> </span></p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">The problem is that the rewrite appears to do nothing; log entries come out unmodified. Am I missing something?</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">Thank you –</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">Jon Wilson</p>
<p style="margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;"> </p>
</body>
</html>