[syslog-ng] Escaping open bracket and close bracket.

[Evan Rempel]

Your @ESTRING:.from:<>|@

is specifying that the string must end with <>|
but what you really want is a string that ends in |<

Did you copy the line correctly. Your virst email address does not have a trailing >

You could use

@EMAIL:.from:&lt;$gt;|@

which will match the email address and strip off any surrounding < pr > or | characters

The first @EMAIL:.from:&lt;$gt;|@ would leave the parsing pointer at the first
character of the second email.

So your whole pattern would be

@ESTRING::|@@@EMAIL:.from:&lt;$gt;|@@EMAIL:.to:&lt;$gt;|@@ESTRING::|@


On 02/26/2014 04:37 AM, C. L. Martinez wrote:
> Hi all,
>
>   I am trying to escape open and close brackets using a pattern.xml,
> but it doesn't works. Logfile comes in the following format:
>
> 1133422.221|<someuser at domain1.com|<anotheruser at domain2.com>|1.1.1.1|...
>
>   I have tried different patterns .. The last one is:
>
>   <pattern>@ESTRING::|@@ESTRING:.from:&lt;&gt;|@@ESTRING:.to:&lt;&gt;|@@ESTRING::|@</pattern>
>
>   Any ideas??
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>


-- 
Evan Rempel                                      erempel at uvic.ca
Senior Systems Administrator                        250.721.7691
Data Centre Services, University Systems, University of Victoria