Message: 1 Date: Mon, 26 Sep 2011 18:07:00 +0800 From: Luis Pugoy <lpugoy@insynchq.com> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? (Jakub Jankowski) To: syslog-ng@lists.balabit.hu Message-ID: <CA+WGxEhGFX7V9C+71BgcU1TZsb21+FbzX5GdCZ=ZLPEDJ4fYFg@mail.gmail.com
Content-Type: text/plain; charset="iso-8859-1"
On Sun, Sep 25, 2011 at 1:57 AM, Luis Pugoy <lpugoy@insynchq.com> wrote:
Message: 4
Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST) From: Jakub Jankowski <shasta@toxcorp.com> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Message-ID: <alpine.LNX.2.00.1109240928240.15891@bluzg.slackware.pl> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
On 2011-09-24, Luis Pugoy wrote:
rewrite r_rewrite_subst { subst("a*", "?", value("MESSAGE") type("pcre") flags("utf8" "global")); };
I thought that it would replace 0 or more occurrences of 'a' with a question mark. However, when the input is 'a', the output becomes 'a?'. It just appends a question mark at the end. 'aa' also becomes 'aa?'. What is weirder still is that even if the input does not contain 'a', the question mark is still appended. So '1' becomes '1?'.
Well, does "1" match /a*/ ? :) It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind of regexp matches everything, even an empty string.
HTH
-- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
Hello Jakub.
Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't the resulting replacement be "?" instead of "1?" ? Also, if I just use /a/ and use "a" as input, it does not seem to match. The text is still outputted as "a".
I don't know the policy regarding bumping threads here, but I'd like to bump this. Can anyone confirm the results I'm getting? Is there also something wrong with my understanding of pcre? I'm sorry if this is not allowed.
I was able to solve my initial problem. The "\p{Zl}" must be changed to "\\p}{Zl}".