On Mon, 2008-01-28 at 14:55 -0500, James Whitt wrote:
I had asked this question about a year ago, but was told to wait for the new 2.0 version. I'm currently running the latest syslog-ng 2.0.7.
What I would like to do is put the line in a specific file based on part of the hostname. For example:
Hostname: subdomain.domain.tld
destination customer_firewall_logs { file("/logs/$TLD/$DOMAIN/$SUBDOMAIN/$R_YEAR-$R_MONTH-$R_DAY.log"); };
WHERE $TLD is the tld of the hostname, $DOMAIN is the domain from the hostname, and $SUBDOMAIN is teh subdomain from the hostname. I would like to be able to regex this information out of the hostname to use in the destination. Is this possible and any tips on getting it to work correctly would be greatly appreciated.
You can do something like this: filter f_tld { hostname("^[a-zA-Z0-9]+\.\(.$\)$"); }; Then your TLD is in the $1 macro, e.g. you can do something like: destination d_file { file("/logs/$1/$DOMAIN/$SUBDOMAIN/$R_YEAR-$R_MONTH-$R_DAY.log"); }; ^^^ You can use up to 256 different $NNN macros, but only one regexp. -- Bazsi