[syslog-ng] Logging only if phrase found

[Sebastian Deißner]

Hi @all,

i am using syslog-ng for logging into mysql.


****************************

options {
         chain_hostnames(off);
         sync(0);
         stats(43200);
};

source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); };

destination d_mysql {
           program("/usr/bin/mysql --user=syslogfeeder 
--password=SuperPassWord syslog" template("INSERT INTO logs (host, 
facility, priority, level, tag, datetime, program, msg) VALUES ( 
'$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY 
$HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
           template-escape(yes)); };

destination messages { file("/var/log/messages"); };

log {
         source(src);destination(messages); destination(d_mysql);
};

****************************

I want to have only the entries in my log database, that contain a 
specific phrase, for example all the entries with "...connect..."


Is this possible with syslog-ng?

tnx

Sebastian