Message: 4 Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST) From: Jakub Jankowski <shasta@toxcorp.com> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Message-ID: <alpine.LNX.2.00.1109240928240.15891@bluzg.slackware.pl> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
On 2011-09-24, Luis Pugoy wrote:
rewrite r_rewrite_subst { subst("a*", "?", value("MESSAGE") type("pcre") flags("utf8" "global")); };
I thought that it would replace 0 or more occurrences of 'a' with a question mark. However, when the input is 'a', the output becomes 'a?'. It just appends a question mark at the end. 'aa' also becomes 'aa?'. What is weirder still is that even if the input does not contain 'a', the question mark is still appended. So '1' becomes '1?'.
Well, does "1" match /a*/ ? :) It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind of regexp matches everything, even an empty string.
HTH
-- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
Hello Jakub. Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't the resulting replacement be "?" instead of "1?" ? Also, if I just use /a/ and use "a" as input, it does not seem to match. The text is still outputted as "a".