Hi, You don't need to escape it, it will work as you want to use (": "). The pattern that I am using: <pattern>@NUMBER:seqno@: @ESTRING:CISCO.DATE:: @@ANYSTRING:arg2@</pattern> pdbtool output: root@thor:/opt/syslog-ng# bin/pdbtool match -p /opt/syslog-ng/var/patterndb.xml -M "20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up" MESSAGE=20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up .classifier.class=system .classifier.rule_id=09944c71-95eb-4bc0-8575-936931d85713 seqno=20 CISCO.DATE=*Feb 28 15:00:08.556 AKST arg2=%LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up testvalue=OK and it also works with syslog-ng. Glen Johnson wrote:
you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @ Similarly, if you need to use @ in a parser, you can escape it like @@
Tested this using pdbtool match, using several permutations. I couldn't get a match. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- pzolee