[syslog-ng] escaping \[ not respected

[Balazs Scheidler]

I'm Ccing the documentation team to check how well this is covered in
the docs.

I'd welcome alternative syntaxes that'd prevent having to do double
escaping.

I was thinking about the slash syntax like:

Perl style:

match(/no need to escape here\./)

the problem is that with 3.0 we have PCRE in which case it would become:

match(/pattern/ type(pcre))

which is not too perlish anymore.

What about Python style:

match("""no need to escape here\."""

The drawback with this is that Python does escaping in multiline string
literals.

Do you have any more alternatives in mind?

On Wed, 2008-10-01 at 10:35 -0500, Christopher Cashell wrote:
> I think you've nailed it here.  My understanding is that Syslog-NG does
> it's own backslash escaping before passing the string to the regex
> engine which then does the regex backslash escaping.  That means you
> need to double your backslash in those cases.
> 
> I've also found this to be the case for periods and carrots.  If you do
> '\.' it will still match any character as syslog-ng strips the first
> backslash before passing through the regex.  To match a real period you
> need to do '\\.' (same with '\^', to match a real carrot you need '\\^').
> 
> I don't remember if, or how well, this is documented.  I know it kicked
> my butt pretty good until I figured out that I needed to backslash
> escape the backslash escape in a regex, though.  Specifically, when
> using single escaped periods, I was getting bitten with IP address
> regex's that were inexplicably matching things they shouldn't be.
> 
-- 
Bazsi