subst() pcre escape sequences
Ok, I'm trying to lowercase a certain macro with a pcre rewrite rule. Unfortunately it doesnt seem to be observing pcre escape sequences. subst('^(.+)$','\L$1\E',value('FROM') flags('store-matches') type('pcre')); (the FROM macro is created from the named match of an earlier pcre filter() It ends up just putting a literal '\L' and '\E' at the start and end of the string. Is this a bug, or am I doing something wrong, or is there another way to do this?
try a \Q instead of \L On 3/10/2010 6:47 PM, Patrick H. wrote:
Ok, I'm trying to lowercase a certain macro with a pcre rewrite rule. Unfortunately it doesnt seem to be observing pcre escape sequences. subst('^(.+)$','\L$1\E',value('FROM') flags('store-matches') type('pcre')); (the FROM macro is created from the named match of an earlier pcre filter() It ends up just putting a literal '\L' and '\E' at the start and end of the string. Is this a bug, or am I doing something wrong, or is there another way to do this?
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
\Q is quote in pcre, not what I need to do. Plus its not evaluating the escapes at all. I'm guessing that syslog-ng isnt passing the second argument of the subst() to pcre, but is doing to replacement itself (havent dug through the code). Sent: Thursday, March 11, 2010 12:31:08 PM From: Paul Robert Marino <prmarino1@gmail.com> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: Re: [syslog-ng] subst() pcre escape sequences
try a \Q instead of \L
On 3/10/2010 6:47 PM, Patrick H. wrote:
Ok, I'm trying to lowercase a certain macro with a pcre rewrite rule. Unfortunately it doesnt seem to be observing pcre escape sequences. subst('^(.+)$','\L$1\E',value('FROM') flags('store-matches') type('pcre')); (the FROM macro is created from the named match of an earlier pcre filter() It ends up just putting a literal '\L' and '\E' at the start and end of the string. Is this a bug, or am I doing something wrong, or is there another way to do this?
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
------------------------------------------------------------------------
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
On Thu, 2010-03-11 at 12:36 -0700, Patrick H. wrote:
\Q is quote in pcre, not what I need to do. Plus its not evaluating the escapes at all. I'm guessing that syslog-ng isnt passing the second argument of the subst() to pcre, but is doing to replacement itself (havent dug through the code).
This is true, syslog-ng inteprets the second argument as a template, allowing you to do macro expansion. -- Bazsi
participants (3)
-
Balazs Scheidler
-
Patrick H.
-
Paul Robert Marino