bypassed the problem in this way $(- $(context-length) 1) And one more question: is it possible to use the context-length instead of a timeout as the context closure value? -----Original Message----- From: Fabien Wernli [mailto:wernli@in2p3.fr] Sent: Thursday, June 20, 2019 12:25 PM To: Газин Максим Алексеевич <Maksim.Gazin@rt.ru> Cc: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: Re: RE: [syslog-ng] grouping-by question Hi, On Thu, Jun 20, 2019 at 07:17:28AM +0000, Газин Максим Алексеевич wrote:
what does it mean? Is it possible to make the context-length equal to the value of the aggregated messages?
In your original email, your config indicated that you were using `timeout(15)` in the grouping-by config. As far as I understand the grouping-by parser, this means that the context will only be closed (and thus context-len reinitialized) if no message matches the condition for 15 seconds.