[syslog-ng] using correlation to filter out some messages ?

[Guillaume Rousse]

Le 18/01/2011 18:13, Guillaume Rousse a écrit :
> As you suggested earlier, the following action in the second rule should
> ensure a message in an empty context is getting re-emited:
> <action trigger="match" condition="${MESSAGE}@1 == ''">
>   <message>
>     <values>
>       <value name="MESSAGE">${MSG}@1</value>
>     </values>
>   </message>
> </action>
This one triggers an error:


Error parsing filter expression, syntax error, unexpected $undefined in
<string> at line 1, column 2:

${
 ^
...
Error parsing pattern database file;
filename='/var/lib/syslog-ng/patterndb.xml', error='Error compiling
conditional expression'

I tried playing with other macros, such as ${HOST}, without success.

Also, I guess the re-emited message should be the current one (${MSG}),
not the previous one (${MSG}@1), for the value element content ?
-- 
BOFH excuse #15:

temporary routing anomaly