[syslog-ng] Two or more conditions on a action

[Evan Rempel]

I have never done this, however, the manual states

"condition: A syslog-ng filter expression. The action is performed only if the message matches the filter. The filter 
can include macros and name-value pairs extracted from the message."

so if you look at the syntax for filters, you do not use the & for logical and, you use the word "and".

So I think your condition should be

<action trigger="match" condition=" '${first_field}@1' == 'something_1' and '${second_field}' == 'something_2' ">

you may need parenthesis, so

<action trigger="match" condition=" '(${first_field}@1' == 'something_1') and ('${second_field}' == 'something_2') ">

Hope this works for you.

Evan.


C. L. Martinez wrote:
> On Fri, Jun 8, 2012 at 7:53 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
>> On Wed, Jun 6, 2012 at 8:48 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
>>> Hi all,
>>>
>>> Â Is it possible to configure two or more conditions under an action??
>>> For example:
>>>
>>> <action trigger="match" condition=" '${first_field}@1' ==
>>> 'something_1' & '${second_field}' == 'something_2' ">
>>>
>>> This action it doesn't works ... I am using syslog-ng 3.3.5
>>>
>>> Thanks.
>> Nothing??
> 
> 
> Please is it possible to do this?? I am doing tests and it seems not
> ... but I am not sure ...
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> 


-- 
Evan Rempel                               erempel at uvic.ca
Senior Systems Administrator                 250.721.7691
Unix Services, University Systems, University of Victoria