Hi, you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @ Similarly, if you need to use @ in a parser, you can escape it like @@ I'll include this in the next version of the adminguide. Robert Glen Johnson wrote:
Hello,
Hopefully this is a new question. I've been trying to write patterns for error messages sent by Cisco IOS devices. For example:
20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
A pattern that works:
@NUMBER:seqno@: @ESTRING:CISCO.DATE: %@LINEPROTO-5-UPDOWN: Line protocol on Interface @ESTRING:arg1:,@ changed state to @ANYSTRING:arg2@
But to avoid capturing the colon an space, the end-match needs to be ": " (i.e. colon space), like so:
@ESTRING:CISCO.DATE:: @
However, I'm unsure how to quote the colon, when it's already the ESTRING param delimiter?
Thanks ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html