There may be a bug as I can't get a single or colon-escaped single colon to match, but as a workaround, this fits the bill: @ESTRING:CISCO.DATE:: @%LINEPROTO... Where the ESTRING match pattern is <colon><space>. It's a greedy match, so the % must immediately follow the @ because the colon and space were parsed and consumed. On Tue, Apr 13, 2010 at 1:11 PM, Fekete Róbert <frobert@balabit.com> wrote:
On Tuesday, April 13, 2010 19:16 CEST, Glen Johnson <gfjohnson@alaska.edu> wrote:
you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @ Similarly, if you need to use @ in a parser, you can escape it like @@
Tested this using pdbtool match, using several permutations. I couldn't get a match. Then this looks like a bug, two independent developers stated that :: should work. I'll get someone take a closer look at it.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html