There may be a bug as I can't get a single or colon-escaped single colon to match, but as a workaround, this fits the bill:

@ESTRING:CISCO.DATE:: @%LINEPROTO...

Where the ESTRING match pattern is <colon><space>.  It's a greedy match, so the % must immediately follow the @ because the colon and space were parsed and consumed.

On Tue, Apr 13, 2010 at 1:11 PM, Fekete Róbert <frobert@balabit.com> wrote:

On Tuesday, April 13, 2010 19:16 CEST, Glen Johnson <gfjohnson@alaska.edu> wrote:

> > you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @
> > Similarly, if you need to use @ in a parser, you can escape it like @@
>
> Tested this using pdbtool match, using several permutations.   I
> couldn't get a match.
Then this looks like a bug, two independent developers stated that :: should work. I'll get someone take a closer look at it.
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>





______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html