I'm Ccing the documentation team to check how well this is covered in the docs. I'd welcome alternative syntaxes that'd prevent having to do double escaping. I was thinking about the slash syntax like: Perl style: match(/no need to escape here\./) the problem is that with 3.0 we have PCRE in which case it would become: match(/pattern/ type(pcre)) which is not too perlish anymore. What about Python style: match("""no need to escape here\.""" The drawback with this is that Python does escaping in multiline string literals. Do you have any more alternatives in mind? On Wed, 2008-10-01 at 10:35 -0500, Christopher Cashell wrote:
I think you've nailed it here. My understanding is that Syslog-NG does it's own backslash escaping before passing the string to the regex engine which then does the regex backslash escaping. That means you need to double your backslash in those cases.
I've also found this to be the case for periods and carrots. If you do '\.' it will still match any character as syslog-ng strips the first backslash before passing through the regex. To match a real period you need to do '\\.' (same with '\^', to match a real carrot you need '\\^').
I don't remember if, or how well, this is documented. I know it kicked my butt pretty good until I figured out that I needed to backslash escape the backslash escape in a regex, though. Specifically, when using single escaped periods, I was getting bitten with IP address regex's that were inexplicably matching things they shouldn't be.
-- Bazsi