[syslog-ng] [Bug 149] New: patterndb action message does not do variable substitution

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=149

           Summary: patterndb action message does not do variable
                    substitution
           Product: syslog-ng
           Version: 3.3.x
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi at balabit.hu
        ReportedBy: erempel at uvic.ca
Type of the Report: ---
   Estimated Hours: 0.0


When using a simple message action in a patterndb rule the message can not be populated with any variables.

I am not using any correlation, I am just performing the message action every time I match the rule pattern.


      <rule id="463e34dd-f946-4f25-9cd2-9c00e25eba62" class="cluster" provider="UVic">
        <patterns>
          <pattern>@ESTRING:: @@ESTRING:: @@NUMBER::@ @NUMBER@:@NUMBER@:@NUMBER at .@NUMBER@ @NUMBER@: VERBS RDMA library libibverbs.so failed to load:
libibverbs.so: cannot open shared object file: No such file or directory.</pattern>
        </patterns>
        <actions>
          <action>
             <message>
               <values>
                 <value name="MESSAGE">$.classifier.rule_id</value>
                 <value name="PROGRAM">patterndb</value>
               </values>
             </message>
          </action>
        </actions>
      </rule>

results in the verbatim log line of

2011-11-28T10:12:21-08:00 int at catamount.comp.uvic.ca kern.emerg patterndb: $.classifier.rule_id

The log line should be

2011-11-28T10:12:21-08:00 int at catamount.comp.uvic.ca kern.emerg patterndb: 463e34dd-f946-4f25-9cd2-9c00e25eba62


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.