This is possible, but with quite ugly syntax. I always wanted to add some syntactic sugar, but never got around to do it. It looks like this: junction { channel { # if, with conditions specified as filters filter { whatever... }; destination { whatever }; flags(final); }; channel { # else, you can add filters as well destination { something else }; flags(final); }; }; The key parts: * This can be embedded to any log statement as it is * It uses inline filters and destinations, but you can use other definitions by using simple parens instead of braces. * flags final which causes processing to be stopped at the first match. Without that, you'd be duplicating messages, if the conditions overlap. * You can add any number of channels, you are not limited to one if/else construct. It is more like a filter based switch with multple potential branches. Hope this helps, On May 9, 2017 01:03, "Jorge Pereira" <jpereiran@gmail.com> wrote:

Ops! The documentation explaining only to use with templates.

Basically, I am looking for how to do the below pseudo-code.

destination { if ($R_MIN >= 0 && $R_MIN < 30) file("/path/file_00m-15m.log"); else file("/path/file_30m-60m.log"); endif() };

p.s: I need to save the logs in chunks of 30 minutes being 00m-30m & 31m-60m

-- Jorge Pereira

On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

...

never mind, I found it.

https://www.balabit.com/documents/syslog-ng-ose-latest- guides/en/syslog-ng-ose-guide-admin/html/reference-template- functions.html

-- Jorge Pereira

On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

...

hi team, is it possible to use if() ... else statements on syslog-ng 3.7? I am trying to do something like.

if ($value >= X) ...... else ...... -- Jorge Pereira

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

My approach is: rewrite { # e.g: 20170417/1000PM set("00", value("min_slice"), condition("$R_MIN" >= "0")); set("05", value("min_slice"), condition("$R_MIN" >= "5")); set("10", value("min_slice"), condition("$R_MIN" >= "10")); set("15", value("min_slice"), condition("$R_MIN" >= "15")); set("20", value("min_slice"), condition("$R_MIN" >= "20")); set("25", value("min_slice"), condition("$R_MIN" >= "25")); set("30", value("min_slice"), condition("$R_MIN" >= "30")); set("35", value("min_slice"), condition("$R_MIN" >= "35")); set("40", value("min_slice"), condition("$R_MIN" >= "40")); set("45", value("min_slice"), condition("$R_MIN" >= "45")); set("50", value("min_slice"), condition("$R_MIN" >= "50")); set("55", value("min_slice"), condition("$R_MIN" >= "55")); # final macro set("${YEAR}${MONTH}${DAY}-${HOUR12}${min_slice}${AMPM}", value("logfmt_file")); set("${YEAR}${MONTH}${DAY}/${HOUR12}${min_slice}${AMPM}", value("logfmt_dir")); }; -- Jorge Pereira On Tue, May 9, 2017 at 4:00 AM, James Elstone <james@elstone.net> wrote:

Hi,

Are multiple channel{} commands processed in parallel or sequentially?

Kr,

James

On 9 May 2017 07:20:05 BST, "Scheidler, Balázs" < balazs.scheidler@balabit.com> wrote:

...

This is possible, but with quite ugly syntax. I always wanted to add some syntactic sugar, but never got around to do it.

It looks like this:

junction { channel { # if, with conditions specified as filters filter { whatever... }; destination { whatever }; flags(final); }; channel { # else, you can add filters as well destination { something else }; flags(final); }; };

The key parts: * This can be embedded to any log statement as it is * It uses inline filters and destinations, but you can use other definitions by using simple parens instead of braces. * flags final which causes processing to be stopped at the first match. Without that, you'd be duplicating messages, if the conditions overlap. * You can add any number of channels, you are not limited to one if/else construct. It is more like a filter based switch with multple potential branches.

Hope this helps,

On May 9, 2017 01:03, "Jorge Pereira" <jpereiran@gmail.com> wrote:

...

Ops! The documentation explaining only to use with templates.

Basically, I am looking for how to do the below pseudo-code.

destination { if ($R_MIN >= 0 && $R_MIN < 30) file("/path/file_00m-15m.log"); else file("/path/file_30m-60m.log"); endif() };

p.s: I need to save the logs in chunks of 30 minutes being 00m-30m & 31m-60m

-- Jorge Pereira

On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

...

never mind, I found it.

https://www.balabit.com/documents/syslog-ng-ose-latest-guide s/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html

-- Jorge Pereira

On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

...

hi team, is it possible to use if() ... else statements on syslog-ng 3.7? I am trying to do something like.

if ($value >= X) ...... else ...... -- Jorge Pereira

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Hi Balazs, Sorry, But I didn't get your suggestion as well. do you mind to be more clearly? -- Jorge Pereira On Wed, May 10, 2017 at 3:42 AM, Balazs Scheidler <bazsi77@gmail.com> wrote:

I think we have a $(/ $R_MIN 5) template function for integer division, likewise we have multiplication as well, which you can use to achieve the same a lot easier.

On May 9, 2017 19:41, "Jorge Pereira" <jpereiran@gmail.com> wrote:

...

My approach is:

rewrite { # e.g: 20170417/1000PM set("00", value("min_slice"), condition("$R_MIN" >= "0")); set("05", value("min_slice"), condition("$R_MIN" >= "5")); set("10", value("min_slice"), condition("$R_MIN" >= "10")); set("15", value("min_slice"), condition("$R_MIN" >= "15")); set("20", value("min_slice"), condition("$R_MIN" >= "20")); set("25", value("min_slice"), condition("$R_MIN" >= "25")); set("30", value("min_slice"), condition("$R_MIN" >= "30")); set("35", value("min_slice"), condition("$R_MIN" >= "35")); set("40", value("min_slice"), condition("$R_MIN" >= "40")); set("45", value("min_slice"), condition("$R_MIN" >= "45")); set("50", value("min_slice"), condition("$R_MIN" >= "50")); set("55", value("min_slice"), condition("$R_MIN" >= "55"));

# final macro set("${YEAR}${MONTH}${DAY}-${HOUR12}${min_slice}${AMPM}", value("logfmt_file")); set("${YEAR}${MONTH}${DAY}/${HOUR12}${min_slice}${AMPM}", value("logfmt_dir")); };

-- Jorge Pereira

On Tue, May 9, 2017 at 4:00 AM, James Elstone <james@elstone.net> wrote:

...

Hi,

Are multiple channel{} commands processed in parallel or sequentially?

Kr,

James

On 9 May 2017 07:20:05 BST, "Scheidler, Balázs" < balazs.scheidler@balabit.com> wrote:

...

This is possible, but with quite ugly syntax. I always wanted to add some syntactic sugar, but never got around to do it.

It looks like this:

junction { channel { # if, with conditions specified as filters filter { whatever... }; destination { whatever }; flags(final); }; channel { # else, you can add filters as well destination { something else }; flags(final); }; };

The key parts: * This can be embedded to any log statement as it is * It uses inline filters and destinations, but you can use other definitions by using simple parens instead of braces. * flags final which causes processing to be stopped at the first match. Without that, you'd be duplicating messages, if the conditions overlap. * You can add any number of channels, you are not limited to one if/else construct. It is more like a filter based switch with multple potential branches.

Hope this helps,

On May 9, 2017 01:03, "Jorge Pereira" <jpereiran@gmail.com> wrote:

...

Ops! The documentation explaining only to use with templates.

Basically, I am looking for how to do the below pseudo-code.

destination { if ($R_MIN >= 0 && $R_MIN < 30) file("/path/file_00m-15m.log"); else file("/path/file_30m-60m.log"); endif() };

p.s: I need to save the logs in chunks of 30 minutes being 00m-30m & 31m-60m

-- Jorge Pereira

On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

...

never mind, I found it.

https://www.balabit.com/documents/syslog-ng-ose-latest-guide s/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html

-- Jorge Pereira

On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

> hi team, > is it possible to use if() ... else statements on syslog-ng 3.7? I > am trying to do something like. > > if ($value >= X) > ...... > else > ...... > -- > Jorge Pereira >

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support /documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support /documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Yes, you can also combine the first two: $(* $(/ $R_MIN 5) 5) It would be nice to have a template function that does the padding, but right now we dont have that. In that case it could be like this: $(str-pad --width 2 --right --pad 0 $(* $(/ $R_MIN 5) 5)) Or something like that. A specialized template function that does exactly this could also br useful: $(slice $R_MIN 5) Although the naming can be tricky (I don't think slice conveys the meaning well enough). Creating a simple template function is not too difficult, just look at the basicfuncs module. One with arguments is more difficult though. Bazsi On May 11, 2017 6:29 AM, "Jorge Pereira" <jpereiran@gmail.com> wrote:

Balazs,

Something like that?

set("$(/ $R_MIN 5)", value("min_slice")); set("$(* $min_slice 5)", value("min_slice")); set("0${min_slice}", value("min_slice"), condition("min_slice" < "10")); # pad the "0"

-- Jorge Pereira

On Wed, May 10, 2017 at 7:50 PM, Jorge Pereira <jpereiran@gmail.com> wrote:

...

Hi Balazs,

Sorry, But I didn't get your suggestion as well. do you mind to be more clearly?

-- Jorge Pereira

On Wed, May 10, 2017 at 3:42 AM, Balazs Scheidler <bazsi77@gmail.com> wrote:

...

I think we have a $(/ $R_MIN 5) template function for integer division, likewise we have multiplication as well, which you can use to achieve the same a lot easier.

On May 9, 2017 19:41, "Jorge Pereira" <jpereiran@gmail.com> wrote:

...

My approach is:

rewrite { # e.g: 20170417/1000PM set("00", value("min_slice"), condition("$R_MIN" >= "0")); set("05", value("min_slice"), condition("$R_MIN" >= "5")); set("10", value("min_slice"), condition("$R_MIN" >= "10")); set("15", value("min_slice"), condition("$R_MIN" >= "15")); set("20", value("min_slice"), condition("$R_MIN" >= "20")); set("25", value("min_slice"), condition("$R_MIN" >= "25")); set("30", value("min_slice"), condition("$R_MIN" >= "30")); set("35", value("min_slice"), condition("$R_MIN" >= "35")); set("40", value("min_slice"), condition("$R_MIN" >= "40")); set("45", value("min_slice"), condition("$R_MIN" >= "45")); set("50", value("min_slice"), condition("$R_MIN" >= "50")); set("55", value("min_slice"), condition("$R_MIN" >= "55"));

# final macro set("${YEAR}${MONTH}${DAY}-${HOUR12}${min_slice}${AMPM}", value("logfmt_file")); set("${YEAR}${MONTH}${DAY}/${HOUR12}${min_slice}${AMPM}", value("logfmt_dir")); };

-- Jorge Pereira

On Tue, May 9, 2017 at 4:00 AM, James Elstone <james@elstone.net> wrote:

...

Hi,

Are multiple channel{} commands processed in parallel or sequentially?

Kr,

James

On 9 May 2017 07:20:05 BST, "Scheidler, Balázs" < balazs.scheidler@balabit.com> wrote:

...

This is possible, but with quite ugly syntax. I always wanted to add some syntactic sugar, but never got around to do it.

It looks like this:

junction { channel { # if, with conditions specified as filters filter { whatever... }; destination { whatever }; flags(final); }; channel { # else, you can add filters as well destination { something else }; flags(final); }; };

The key parts: * This can be embedded to any log statement as it is * It uses inline filters and destinations, but you can use other definitions by using simple parens instead of braces. * flags final which causes processing to be stopped at the first match. Without that, you'd be duplicating messages, if the conditions overlap. * You can add any number of channels, you are not limited to one if/else construct. It is more like a filter based switch with multple potential branches.

Hope this helps,

On May 9, 2017 01:03, "Jorge Pereira" <jpereiran@gmail.com> wrote:

> Ops! The documentation explaining only to use with templates. > > Basically, I am looking for how to do the below pseudo-code. > > destination { > if ($R_MIN >= 0 && $R_MIN < 30) > file("/path/file_00m-15m.log"); > else > file("/path/file_30m-60m.log"); > endif() > }; > > p.s: I need to save the logs in chunks of 30 minutes being 00m-30m & > 31m-60m > > -- > Jorge Pereira > > On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <jpereiran@gmail.com> > wrote: > >> never mind, I found it. >> >> https://www.balabit.com/documents/syslog-ng-ose-latest-guide >> s/en/syslog-ng-ose-guide-admin/html/reference-template-funct >> ions.html >> >> -- >> Jorge Pereira >> >> On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <jpereiran@gmail.com> >> wrote: >> >>> hi team, >>> is it possible to use if() ... else statements on syslog-ng 3.7? I >>> am trying to do something like. >>> >>> if ($value >= X) >>> ...... >>> else >>> ...... >>> -- >>> Jorge Pereira >>> >> >> > > ____________________________________________________________ > __________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support > /documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > >

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support /documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support /documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support /documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

On Wed, May 10, 2017 at 10:34:19PM -0700, Evan Rempel wrote:

$(padding <macro> <prepended characters>)

but the examples show a length argument

$(padding $MESSAGE 10 X): bar would produce a result of XXXXXXXbar

I think the doc is somewhat wrong. Here's what we use for example in our patterndb: <value name='hpss.msg_id'>${hpss.subsystem}$(padding "${hpss.message_num}" "4" "0")</value> And in the example: hpss.subsystem: 'PVLS' hpss.message_num: '100' hpss.msg_id: 'PVLS0100'