On Mon, 2011-05-02 at 14:34 +0200, Daniel Maher wrote:
Hello,
While following the example given here : http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid...
I copied and pasted the string, then attempted to restart the daemon; unfortunately, this was the result :
--- Error parsing rewrite expression, syntax error, unexpected LL_IDENTIFIER, expecting ')' in /etc/syslog-ng/syslog-ng.conf at line 354, column 27:
{subst("a*", "?", field("message") type("pcre") flags("utf8" "global")); }; ^^^^^
This is a genuine docbug, field() should be value(). Although the name-value pair you are probalby trying to reference is MESSAGE and not message. Case matters. So that's probably another docbug. Cc-ing the doc team. -- Bazsi