[syslog-ng] Help with pattern db correlation

[Martin Holste]

I get the same thing with braces: just the number shows up.

I'll mess around with grep to see if I can get it to work.

On Saturday, December 18, 2010, Balazs Scheidler <bazsi at balabit.hu> wrote:
> On Fri, 2010-12-17 at 14:28 -0600, Martin Holste wrote:
>> If I change it to
>> <value name="MESSAGE">IronPort message complete: icid: $icid at 2, mid:
>> $mid</value>
>> then the output shows "IronPort message complete: icid: @2, mid:
>> 285561684" no matter what value I use for the integer.  If it doesn't
>> exist then it should be null.
>
> The '@' only works with the brace based syntax of variable expansion,
> e.g. it needs to be:
>
> ${icid}@1
>
>>
>> This does bring up the problem of when you don't know how many lines
>> back your variable exists.  Can you use $(grep) in that situation?
>
> yes.
>
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>