[syslog-ng] Using Regex information for destination

[James Whitt]

I just noticed an issues with my filter using regex, so I'm hoping that
someone can help me figure this out. I'm running version 2.0.9.  I have
internal hostnames that I use with a central log system.  The issue is that
if I use a host like:

hostr01.w01.primary

It should go to /logs/primary/wireless/hostr01.r01.primary/, but if the
router filter is above the wireless filter, the it's actually going into
/logs/primary/wireless/hostr01.r01.primary/.  It appears to be ignoring or
matching the . even thought I have it with a \..  Any help with this would
be greatly appreciated.  If I didn't have the final(), it would log to both
places.


Here is the snippet of the config that deals with this.


filter router_filter {
host("^[0-9a-zA-Z\-]+\.r[0-9]{2}\.([0-9a-zA-Z\-]+)$"); };
destination router_logs {
        file("/logs/$1/router/$HOST/$YEAR-$MONTH-$DAY.log");
};
log { source(s_external);
      filter(router_filter);
      destination(router_logs);
      flags(final);
};


filter wireless_filter {
host("^[0-9a-zA-Z\-]+\.w[0-9]{2}\.([0-9a-zA-Z\-]+)$"); };
destination wireless_logs {
        file("/logs/$1/wireless/$HOST/$YEAR-$MONTH-$DAY.log");
};
log { source(s_external);
      filter(wireless_filter);
      destination(wireless_logs);
      flags(final);
};
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080710/e45c8454/attachment-0001.htm