[syslog-ng] Two or more conditions on a action

Evan Rempel erempel at uvic.ca
Thu Jun 14 17:21:31 CEST 2012

I have never done this, however, the manual states

"condition: A syslog-ng filter expression. The action is performed only if the message matches the filter. The filter 
can include macros and name-value pairs extracted from the message."

so if you look at the syntax for filters, you do not use the & for logical and, you use the word "and".

So I think your condition should be

<action trigger="match" condition=" '${first_field}@1' == 'something_1' and '${second_field}' == 'something_2' ">

you may need parenthesis, so

<action trigger="match" condition=" '(${first_field}@1' == 'something_1') and ('${second_field}' == 'something_2') ">

Hope this works for you.


C. L. Martinez wrote:
> On Fri, Jun 8, 2012 at 7:53 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
>> On Wed, Jun 6, 2012 at 8:48 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
>>> Hi all,
>>> Â Is it possible to configure two or more conditions under an action??
>>> For example:
>>> <action trigger="match" condition=" '${first_field}@1' ==
>>> 'something_1' & '${second_field}' == 'something_2' ">
>>> This action it doesn't works ... I am using syslog-ng 3.3.5
>>> Thanks.
>> Nothing??
> Please is it possible to do this?? I am doing tests and it seems not
> ... but I am not sure ...
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Evan Rempel                               erempel at uvic.ca
Senior Systems Administrator                 250.721.7691
Unix Services, University Systems, University of Victoria

More information about the syslog-ng mailing list