16 Nov
2010
16 Nov
'10
5:13 p.m.
No, they are unescaped, not escaped.
Sorry, I misread that. Where exactly are you getting these logs from? Remember that ESTRING can accept multi-character sequences: "As of syslog-ng 3.1, it is possible to specify a stopstring instead of a single character, e.g., @ESTRING::stop_here.@. The @ character cannot be a stopcharacter, nor can line-breaks or tabs." ...so if you're building the log messages yourself you could (as a simple example) embed the URIs inside of |BEGINURI|...|ENDURI| pairs, and then use |ENDURI| as your match.