Re: [syslog-ng] Completing an empty field with specific value

On Tue, May 29, 2012 at 8:52 AM, C. L. Martinez <carlopmart@gmail.com> wrote:

Hi all,

 I am trying to complete an empty field with a specific value when I need to correlate postfix logs. Sometimes From filed comes empty:

 May 29 08:18:04 testsrv postfix/smtp[1569]: E2B653F2: from=<> ...

 I have tried to do this using "value" options in my patterndb.xml:

a) <value name="nosender">$(if ("${from_address}" == "") "no-sender@no-domain.com" "${from_address}@7")</value> b) <value name="nosender">$(grep "${from_address}" == "") "no-sender@no-domain.com"</value>

 ... but it doesn't works ... Any help??

Please, any help?