[syslog-ng] rewrite part of the message...

[Russell Fulton]

I got this going with:

rewrite r_snarex { subst("\s+This event is generated when.+", "", value("MSGONLY") type("pcre"));};

Does this mean that my syslog_ng does not support pcre? 

Russell

On 11/05/2013, at 2:29 PM, Russell Fulton <r.fulton at auckland.ac.nz> wrote:

> Apologies to those of you who have already seen this on the ELSA list.
> 
> I want to get rid of the explanatory essay that accompanies some eventlog messages from windows.
> 
> I tried this:
> 
> rewrite r_snarex { subst("\s+This event is generated when[^|]+\|", "|", value("MSGONLY") type("pcre"));
> };
> 
> and added it to log section, but it did not work.  I have tried various variations on the theme too.
> 
> Russell
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>