Progress! rewrite r_rewrite_4624_2 { subst("(interactive)", "QuackApple", value("MSGONLY") type("string") flags("substring"));}; works to replace the single word.. Now to build upon that! (I had previously added the substring flag but had never used the 'string' type AND the substring flag at once Dave Vernon Technology Infrastructure Specialist Information Technology Services Loyalist College 613-969-1913 x2827 dvernon@loyalistc.on.ca | www.loyalistcollege.com -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Matt Zagrabelny Sent: Friday, July 19, 2013 12:30 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Help getting my rewrite to work Hi Dave,
rewrite r_rewrite_4624_2 { subst("interactive", "QuackApple", value("MSGONLY"));};
I'm using something similar, but am using the type and flags options: rewrite r_use_basename { subst( "/var/log/apache2/", "", value(".SDATA.file@18372.4.name") type("string") flags("prefix") ); };
From the admin pdf:
string Description: Match the strings literally, without regular expression support. By default, only identical strings are matched. For partial matches, use the flags("prefix") or the flags("substring") flags. One would think that your regex would match, though. Cheers, -mz ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq