Is there a way I can do a case insensitive match in syslog-ng? Every place I've seen from grep to python to perl has their own way of doing the case insensitive flag. So how do I set the case-insensitive match flag in syslog-ng? Hari
On Mon, 2006-08-07 at 18:10 +0100, Hari Sekhon wrote:
Is there a way I can do a case insensitive match in syslog-ng?
Every place I've seen from grep to python to perl has their own way of doing the case insensitive flag.
So how do I set the case-insensitive match flag in syslog-ng?
Simple answer: you can't. Longer answer: you can't currently as noone has ever asked this before (or at least I can't remember). Do you happen to have a suggestion how this should look like? -- Bazsi
Balazs Scheidler wrote:
On Mon, 2006-08-07 at 18:10 +0100, Hari Sekhon wrote:
Is there a way I can do a case insensitive match in syslog-ng?
Every place I've seen from grep to python to perl has their own way of doing the case insensitive flag.
So how do I set the case-insensitive match flag in syslog-ng?
Simple answer: you can't. Longer answer: you can't currently as noone has ever asked this before (or at least I can't remember).
Do you happen to have a suggestion how this should look like?
It could either stick to the syslog-ng style with a flag() set within match(), or perhaps a character at the end of the string eg. "someregex"i (like perl's /someregex/i ) or cleaner would be just to make imatch() to do insensitive matches... Not being able to do case insensitive searches is an extreme handicap if trying to fully leverage syslog-ng filters. imagine match("login failed") instead becomes match("[Ll][Oo][Gg][Ii][Nn] [Ff][Aa][Ii][Ll][Ee][Dd]") not quite as readable and sticky when you want to match anything longer.. Hari
Trying to keep the syntax consistent across syslog-ng items, I recommend something like match("expr" option(nocase, exact, replace(text), global)) nocase - case insensitive match exact - match the exact text for cases wherey you want to mtach the .*$?^ characters replace - replace the matched text with the included text. this may have effect on successive matches this may include back substitution from the expression. global - match/replace all occurances of the expression. Some of these features may be reserved for version 2.1 Evan Rempel. Balazs Scheidler wrote:
On Mon, 2006-08-07 at 18:10 +0100, Hari Sekhon wrote:
Is there a way I can do a case insensitive match in syslog-ng?
Every place I've seen from grep to python to perl has their own way of doing the case insensitive flag.
So how do I set the case-insensitive match flag in syslog-ng?
Simple answer: you can't. Longer answer: you can't currently as noone has ever asked this before (or at least I can't remember).
Do you happen to have a suggestion how this should look like?
-- Evan Rempel erempel@uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria
participants (3)
-
Balazs Scheidler
-
Evan Rempel
-
Hari Sekhon