[syslog-ng] Help with pattern db correlation

[Balazs Scheidler]

On Fri, 2010-12-17 at 14:28 -0600, Martin Holste wrote:
> If I change it to
> <value name="MESSAGE">IronPort message complete: icid: $icid at 2, mid:
> $mid</value>
> then the output shows "IronPort message complete: icid: @2, mid:
> 285561684" no matter what value I use for the integer.  If it doesn't
> exist then it should be null.

The '@' only works with the brace based syntax of variable expansion,
e.g. it needs to be:

${icid}@1

> 
> This does bring up the problem of when you don't know how many lines
> back your variable exists.  Can you use $(grep) in that situation?

yes.


-- 
Bazsi