[syslog-ng] patterndb ESTRING delimiter char

[Lars Kellogg-Stedman]

> No, they are unescaped, not escaped.

Sorry, I misread that.  Where exactly are you getting these logs from?
 Remember that ESTRING can accept multi-character sequences:

"As of syslog-ng 3.1, it is possible to specify a stopstring instead
of a single character, e.g., @ESTRING::stop_here. at . The @ character
cannot be a stopcharacter, nor can line-breaks or tabs."

...so if you're building the log messages yourself you could (as a
simple example) embed the URIs inside of |BEGINURI|...|ENDURI| pairs,
and then use |ENDURI| as your match.