Thanks Peter and Wernli.
I am trying to use kv parser to extract username from MESSAGE template so that i can use it to compare further .
from below VPN logs , i am trying to extract value LOCAL\user1 and user1 (value-separator("(") pair-separator(")")
Teardown TCP connection 51507415 for outside:
2.2.2.2/60709(LOCAL\user1l) to inside:5,5,5,5/443 duration 0:00:06 bytes 0 Failover primary closed
(user1)
i donot see it maching and any value being saved to $KEY1 to refer the match ,
Below is the conf file .
@version: 3.12
@include "scl.conf"
source s_local {
system();
internal();
};
source s_network { udp(port(514) flags(no-parse));
};
#### PARSER ###
parser p_kv { kv-parser(value-separator("(") pair-separator(")") prefix("kv."));
};
##### VPN LOG ####
#filter f_users { in-list("/var/syslog-ng/user.list", value("${KEY1}")); }; --- Not in Use at present
filter f-syslog { host("1.1.1.1"); };
destination log-vpntest { file("/var/log/vpn/vpntest.log" perm(0644) template("$ISODATE $HOST ${kv.KEY1} $KEY1\n") ); };
log { source(s_network);parser(p_kv);filter(f-syslog);destination(log-vpntest); };
#### VPN LOG ENDS ###
Regards
Gopi Joshi