[syslog-ng] MySQL syslog-ng regex

[Hari Sekhon]

your destination is wrong.

it should something more like this

destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO 
logs (host, facility, priority, level, tag, datetime, program, msg) 
VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', 
'$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") 
template-escape(yes)); };

This will form a proper mysql statement.

But to simplify for your example:

destination d_mysql  {
pipe("/tmp/mysql.pipe"
template("INSERT INTO mydatabase (content_name) VALUES *('$10')*;\n") 
template-escape(yes));
};

Try reviewing your regex to capture only what you want and then try 
again. You could for example try making the regex capture only the bit 
you want so it is contained in $1 instead.

But yes I see there is a problem getting the 10th argument, perhaps one 
of the devs will have more info on how to get $10.

-h

Hari Sekhon



Fat Wallet wrote:
> Hi,
>
> I am having problem inserting logs into MySQL using match() that 
> returns more than 10 arguements.
>
>
> destination d_mysql  {
> pipe("/tmp/mysql.pipe"
> template("INSERT INTO mydatabase (content_name) VALUES ('$10');\n") 
> template-escape(yes));
> };
>
> filter f_filter { match ("^.*?:   
> \"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)$"); 
> };
>
> log { source(s_stunnel); filter(f_filter); destination(d_mysql); };
>
>
> incoming log message is as followed:
> "test1","test2","test3","test4","test5","test6","test7","test8","test9","testN","testN1"
>
> catting mysql.pipe:
> $>cat /tmp/mysql.pipe
>
> INSERT INTO mydatabase (content_name) VALUES ('test10');
>
> So instead of 'testN', I am getting the 'test1' appends with 0 which 
> is 'test10'
>
> Thanks for the help!
>
> ------------------------------------------------------------------------
> Finding fabulous fares is fun.
> Let Yahoo! FareChase search your favorite travel sites 
> <http://farechase.yahoo.com/promo-generic-14795097;_ylc=X3oDMTFtNW45amVpBF9TAzk3NDA3NTg5BF9zAzI3MTk0ODEEcG9zAzEEc2VjA21haWx0YWdsaW5lBHNsawNxMS0wNw--> 
> to find flight and hotel bargains.
> ------------------------------------------------------------------------
>
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
>   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20070301/920fe60c/attachment.htm