[syslog-ng]Quoting ( and ) in a match

[Jim Mozley]

Allan Wind wrote:

> On 2003-12-16T09:52:46+0000, Jim Mozley wrote:
> 
>>Allan Wind wrote:
> 
> 
>>>Dec 11 15:25:10 log_source@pawan amavis[29961]: (29961-01-2) Passed,
>>><syslog-ng-admin@lists.balabit.hu> -> <allanwind@lifeintegrity.com>,
>>>Message-ID: <20031211202502.22100.73262.Mailman@www.balabit.hu>, Hits: 
>>>-1.364
> 
> 
> [...]
> 
> 
>>What is it that you are trying to match?
>>
>>Is it "(ddddd-dd-d) Passed"?
> 
> 
> Good eyes.  I am trying to be very specific and only match("^...
> Passed") which in this case probably works out to:

Just came across something while googling. Do you really want something 
like:

[untested]

filter f_av_passed { program("amavis"); match("Passed"); };

Jim