[syslog-ng] ESTRING terminated by a colon?

[Martin Holste]

There may be a bug as I can't get a single or colon-escaped single colon to
match, but as a workaround, this fits the bill:

@ESTRING:CISCO.DATE:: @%LINEPROTO...

Where the ESTRING match pattern is <colon><space>.  It's a greedy match, so
the % must immediately follow the @ because the colon and space were parsed
and consumed.

On Tue, Apr 13, 2010 at 1:11 PM, Fekete Róbert <frobert at balabit.com> wrote:

>
> On Tuesday, April 13, 2010 19:16 CEST, Glen Johnson <gfjohnson at alaska.edu>
> wrote:
>
> > > you can escape the colon using another colon, like
> @ESTRING:CISCO.DATE::: @
> > > Similarly, if you need to use @ in a parser, you can escape it like @@
> >
> > Tested this using pdbtool match, using several permutations.   I
> > couldn't get a match.
> Then this looks like a bug, two independent developers stated that ::
> should work. I'll get someone take a closer look at it.
> >
> ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.campin.net/syslog-ng/faq.html
> >
> >
>
>
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100413/4e6de830/attachment.htm