[syslog-ng] ESTRING terminated by a colon?

[Robert Fekete]

Hi,
you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @
Similarly, if you need to use @ in a parser, you can escape it like @@

I'll include this in the next version of the adminguide.

Robert

Glen Johnson wrote:

> Hello,
> 
> Hopefully this is a new question.  I've been trying to write patterns
> for error messages sent by Cisco IOS devices.  For example:
> 
> 20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on
> Interface BVI1, changed state to up
> 
> A pattern that works:
> 
> @NUMBER:seqno@: @ESTRING:CISCO.DATE: %@LINEPROTO-5-UPDOWN: Line
> protocol on Interface @ESTRING:arg1:,@ changed state to
> @ANYSTRING:arg2@
> 
> But to avoid capturing the colon an space, the end-match needs to be
> ": "  (i.e. colon space), like so:
> 
> @ESTRING:CISCO.DATE:: @
> 
> However, I'm unsure how to quote the colon, when it's already the
> ESTRING param delimiter?
> 
> 
> Thanks
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
>