[syslog-ng] syslog-ng Digest, Vol 77, Issue 34

[Luis Pugoy]

>
> Message: 1
> Date: Mon, 26 Sep 2011 18:07:00 +0800
> From: Luis Pugoy <lpugoy at insynchq.com>
> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng?
>        (Jakub  Jankowski)
> To: syslog-ng at lists.balabit.hu
> Message-ID:
>        <CA+WGxEhGFX7V9C+71BgcU1TZsb21+FbzX5GdCZ=ZLPEDJ4fYFg at mail.gmail.com
> >
> Content-Type: text/plain; charset="iso-8859-1"
>
> On Sun, Sep 25, 2011 at 1:57 AM, Luis Pugoy <lpugoy at insynchq.com> wrote:
>
> > Message: 4
> >> Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST)
> >> From: Jakub Jankowski <shasta at toxcorp.com>
> >> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng?
> >> To: Syslog-ng users' and developers' mailing list
> >>        <syslog-ng at lists.balabit.hu>
> >> Message-ID: <alpine.LNX.2.00.1109240928240.15891 at bluzg.slackware.pl>
> >> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
> >>
> >> On 2011-09-24, Luis Pugoy wrote:
> >>
> >> > rewrite r_rewrite_subst {  subst("a*", "?", value("MESSAGE")
> >> type("pcre")
> >> > flags("utf8" "global"));  };
> >> >
> >> > I thought that it would replace 0 or more occurrences of 'a' with a
> >> question
> >> > mark. However, when the input is 'a', the output becomes 'a?'. It just
> >> > appends a question mark at the end. 'aa' also becomes 'aa?'. What is
> >> weirder
> >> > still is that even if the input does not contain 'a', the question
> mark
> >> is
> >> > still appended. So '1' becomes '1?'.
> >>
> >> Well, does "1" match /a*/ ? :)
> >> It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind
> of
> >> regexp matches everything, even an empty string.
> >>
> >> HTH
> >>
> >> --
> >> Jakub Jankowski|shasta at toxcorp.com|http://toxcorp.com/
> >> GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
> >
> >
> > Hello Jakub.
> >
> > Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't
> > the resulting replacement be "?" instead of "1?" ? Also, if I just use
> /a/
> > and use "a" as input, it does not seem to match. The text is still
> outputted
> > as "a".
> >
>
> I don't know the policy regarding bumping threads here, but I'd like to
> bump
> this. Can anyone confirm the results I'm getting? Is there also something
> wrong with my understanding of pcre? I'm sorry if this is not allowed.
>

I was able to solve my initial problem. The "\p{Zl}" must be changed to
"\\p}{Zl}".
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110927/148e9d6c/attachment.htm