[syslog-ng] PCRE subst example from documentation produces error

[Balazs Scheidler]

On Mon, 2011-05-02 at 14:34 +0200, Daniel Maher wrote:
> Hello,
> 
> While following the example given here :
> http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guide-admin-en.html/index.html-single.html#example_regexp_pcre
> 
> I copied and pasted the string, then attempted to restart the daemon;
> unfortunately, this was the result :
> 
> ---
> Error parsing rewrite expression, syntax error, unexpected
> LL_IDENTIFIER, expecting ')' in /etc/syslog-ng/syslog-ng.conf at line
> 354, column 27:
> 
>         {subst("a*", "?", field("message") type("pcre") flags("utf8"
> "global"));  };
>                           ^^^^^
> 

This is a genuine docbug, field() should be value(). Although the
name-value pair you are probalby trying to reference is MESSAGE and not
message. Case matters. So that's probably another docbug. Cc-ing the doc
team.

-- 
Bazsi