[syslog-ng] min and max message count condition in	correlation	actions
    Gergely Nagy 
    algernon at balabit.hu
       
    Sat Apr 13 14:32:01 CEST 2013
    
    
  
Evan Rempel <erempel at uvic.ca> writes:
> so the syntax would be
>
> <action condition="$(context-length) == $num">
>
> wher $num is some macro from the pattern used to match a line.
>
> Is that correct?
$num can be pretty much anything: a number, a macro, another template
function - it is entirely up to you. It does not need to be extracted
from the pattern, but that should work too.
-- 
|8]
    
    
More information about the syslog-ng
mailing list