Completing an empty field with specific value
Hi all, I am trying to complete an empty field with a specific value when I need to correlate postfix logs. Sometimes From filed comes empty: May 29 08:18:04 testsrv postfix/smtp[1569]: E2B653F2: from=<> ... I have tried to do this using "value" options in my patterndb.xml: a) <value name="nosender">$(if ("${from_address}" == "") "no-sender@no-domain.com" "${from_address}@7")</value> b) <value name="nosender">$(grep "${from_address}" == "") "no-sender@no-domain.com"</value> ... but it doesn't works ... Any help??
On Tue, May 29, 2012 at 8:52 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
Hi all,
I am trying to complete an empty field with a specific value when I need to correlate postfix logs. Sometimes From filed comes empty:
May 29 08:18:04 testsrv postfix/smtp[1569]: E2B653F2: from=<> ...
I have tried to do this using "value" options in my patterndb.xml:
a) <value name="nosender">$(if ("${from_address}" == "") "no-sender@no-domain.com" "${from_address}@7")</value> b) <value name="nosender">$(grep "${from_address}" == "") "no-sender@no-domain.com"</value>
... but it doesn't works ... Any help??
Please, any help?
participants (1)
-
C. L. Martinez