That was mine, and I think there's a couple mistakes in it because there appears to a be a missing parenthesis and a plus sign. Try this: match('%([^:]+):\s+([^\n]+)' value("MESSAGE") type("pcre") On Wed, Nov 30, 2011 at 11:26 AM, Thomas Wollner <tw@wollner-net.de> wrote:
Hello List,
I try to rewrite cisco IOS syslog messages with timestamps in the MESSAGE field. I want to remove the timestamp from the message and set the program to the so called mnemonic of the message..
I found the following example on the list:
... filter f_rewrite_cisco_program { match('%([^:]: ([^\n]+)' value("MESSAGE") type("pcre") flags("store-matches" "nobackref")); };
rewrite r_cisco_program { set("$1", value("PROGRAM") condition(filter(f_rewrite_cisco_program))); set("$2", value("MESSAGE") condition(filter(f_rewrite_cisco_program))); };
log { source(s_all); rewrite(r_cisco_program); destination(d_mydestination); };
But that does not work. I tried a lot of different rewrite syntaxes, none of them work for me. If I just employ the filter f_rewrite_cisco_program I` am able to filter out the cisco messages.
Sample log line (written with template $R_ISODATE $HOST $MSG):
2011-11-30T18:23:50+01:00 192.168.1.1 217122: Nov 30 17:23:49: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
I`m using syslog-ng 3.3.3 debian package from madhouse.
How I can rewrite my messages to filter the timestamp in the message field? any ideas?
Any help is higly welcome, thanks in advance,
Tom
---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq