[syslog-ng] Can't seem to do a simple parse

21 Sep 2012

      I am trying to do a very simple parsing test to reformat a message using
syslog-ng 3.3.6 and I can't seem to use the value of my macro
(mystring):

patterndb (test.xml):

<patterndb version='4' pub_date='2012-09-21'>

    <ruleset name='test' id='123456678'>

        <pattern>test</pattern>

            <rules>

                <rule provider='me' id='182437592347598' class='system'>

                    <patterns>

                        <pattern>@STRING:mystring: @</pattern>

                    </patterns>

                </rule>

            </rules>

    </ruleset>

</patterndb>

pdbtool results:

[root@loghost01 syslog-ng]# pdbtool match -c -D -v -p test.xml -P test
-M "INSERT INTO Test (id, value) VALUES (1, .044212)"

Pattern matching part:

@STRING:mystring=INSERT INTO Test @

Matching part:

INSERT INTO Test

Values:

MESSAGE=INSERT INTO Test (id, value) VALUES (1, .044212)

PROGRAM=test

.classifier.class=unknown

TAGS=.classifier.unknown

relevent syslog-ng.conf lines:

source s_remote { tcp(); };

parser p_test   { db-parser(file("/etc/syslog-ng/test.xml")); };

destination d_test { file("/var/log/splunk/$HOST" template("Here is the
message: ${R_DATE} ${mystring}\n")); };

log { source(s_remote); parser(p_test); destination(d_test); };\n")); };

Results from logger "INSERT INTO Test (id, value) VALUES (1, .044212)"
on client are:

Here is the message: Sep 21 16:46:53

Value of ${mystring} is null.  What am I missing?

[syslog-ng] Can't seem to do a simple parse

Tracy Dalzell