[syslog-ng] patterndb ESTRING delimiter char
lars at oddbit.com
Tue Nov 16 18:13:22 CET 2010
> No, they are unescaped, not escaped.
Sorry, I misread that. Where exactly are you getting these logs from?
Remember that ESTRING can accept multi-character sequences:
"As of syslog-ng 3.1, it is possible to specify a stopstring instead
of a single character, e.g., @ESTRING::stop_here. at . The @ character
cannot be a stopcharacter, nor can line-breaks or tabs."
...so if you're building the log messages yourself you could (as a
simple example) embed the URIs inside of |BEGINURI|...|ENDURI| pairs,
and then use |ENDURI| as your match.
More information about the syslog-ng