[syslog-ng] Rewrite backreference oddity

[Patrick Hemmer]

Oh, I didnt notice that it was at the end of the string, I just saw the 
empty spot. DOH!
Sorry :-)
Smells like a bug to me.

-Patrick

Sent: Mon Feb 27 2012 14:11:14 GMT-0500 (EST)
From: Ti Leggett <leggett at mcs.anl.gov>
To: Patrick Hemmer <syslogng at stormcloud9.net> Syslog-ng users' and 
developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: [syslog-ng] Rewrite backreference oddity
> Neither of those seem to help. If you notice, the back-reference is getting applied, just at the end of the string instead of where it should be. That's the really weird thing to me.
>
> On Feb 27, 2012, at 12:22 PM, Patrick Hemmer wrote:
>
>> Sent: Mon Feb 27 2012 13:18:03 GMT-0500 (EST)
>> From: Ti Leggett<leggett at mcs.anl.gov>
>> To: syslog-ng at lists.balabit.hu
>> Subject: [syslog-ng] Rewrite backreference oddity
>>> I have a rewrite rule that is used to replace private IPs that have no DNS name to an internally used name. It looks like:
>>>
>>> rewrite r_ddn { subst("172.30.60.(\d*)", "d9550-$1.example.com", value("HOST"), type("pcre")); };
>>>
>>>
>>> For IP 172.30.60.1 I should get a HOST that is d9550-1.example.com, but what I actually get is d9550-.example.com1. Any ideas what I'm doing incorrectly? I've tried encapsulating the back reference in {}. Here's info about my syslog-ng:
>> You shouldnt have a comma before the `type`. The config parser might be allowing this, though the general syntax used is to not have one.
>>
>> Also try using `flags(store-matches)`
>>
>> -Patrick