[syslog-ng] pattern matching on xxx#

[Matthew Hall]

On Mon, Oct 18, 2010 at 12:25:50PM -0600, Bill Anderson wrote:
> 
> On Oct 18, 2010, at 11:48 AM, Bill Anderson wrote:
> > 
> > 
> > Perhaps doing the rewrite then using a patterndb entry? I'll go try that.
> 
> Nope. Rewriting host1 to host-1 then calling the patterndb does not 
> work. Reasoning: rewriting the APACHE.ROLEHOST has no effect on $MSG, 
> which is what the patterndb gets.  Which in hindsight, I should have 
> known.

Hi Bill,

I did try to follow your first email but it got complicated and covered 
some areas of the syslog-ng product I have not used before so I am not 
sure if you tried this already or not.

I was thinking maybe you might be able to help your situation by using 
APACHE.ROLEHOST in the output file naming template. Once you have added 
that variable to the message it should stay there despite further 
parsings with CSV or patterndb unless overwritten.

So once you created the APACHE.ROLEHOST variable the first time using 
CSV parser, you could still probably reference it in your arguments to 
the file() driver or other output driver template.

> Cheers,
> Bill

Good Luck,
Matthew.