[syslog-ng] is it possible to use if() ... else statements on syslog-ng 3.7?

[Jorge Pereira]

Balazs,

Something like that?

set("$(/ $R_MIN 5)", value("min_slice"));
set("$(* $min_slice 5)", value("min_slice"));
set("0${min_slice}", value("min_slice"), condition("min_slice" < "10")); #
pad the "0"


--
Jorge Pereira

On Wed, May 10, 2017 at 7:50 PM, Jorge Pereira <jpereiran at gmail.com> wrote:

> Hi Balazs,
>
> Sorry, But I didn't get your suggestion as well. do you mind to be more
> clearly?
>
> --
> Jorge Pereira
>
> On Wed, May 10, 2017 at 3:42 AM, Balazs Scheidler <bazsi77 at gmail.com>
> wrote:
>
>> I think we have a $(/ $R_MIN 5) template function for integer division,
>> likewise we have multiplication as well, which you can use to achieve the
>> same a lot easier.
>>
>> On May 9, 2017 19:41, "Jorge Pereira" <jpereiran at gmail.com> wrote:
>>
>>> My approach is:
>>>
>>>     rewrite {
>>>         # e.g: 20170417/1000PM
>>>         set("00", value("min_slice"), condition("$R_MIN" >= "0"));
>>>         set("05", value("min_slice"), condition("$R_MIN" >= "5"));
>>>         set("10", value("min_slice"), condition("$R_MIN" >= "10"));
>>>         set("15", value("min_slice"), condition("$R_MIN" >= "15"));
>>>         set("20", value("min_slice"), condition("$R_MIN" >= "20"));
>>>         set("25", value("min_slice"), condition("$R_MIN" >= "25"));
>>>         set("30", value("min_slice"), condition("$R_MIN" >= "30"));
>>>         set("35", value("min_slice"), condition("$R_MIN" >= "35"));
>>>         set("40", value("min_slice"), condition("$R_MIN" >= "40"));
>>>         set("45", value("min_slice"), condition("$R_MIN" >= "45"));
>>>         set("50", value("min_slice"), condition("$R_MIN" >= "50"));
>>>         set("55", value("min_slice"), condition("$R_MIN" >= "55"));
>>>
>>>         # final macro
>>>         set("${YEAR}${MONTH}${DAY}-${HOUR12}${min_slice}${AMPM}",
>>> value("logfmt_file"));
>>>         set("${YEAR}${MONTH}${DAY}/${HOUR12}${min_slice}${AMPM}",
>>> value("logfmt_dir"));
>>>     };
>>>
>>> --
>>> Jorge Pereira
>>>
>>> On Tue, May 9, 2017 at 4:00 AM, James Elstone <james at elstone.net> wrote:
>>>
>>>> Hi,
>>>>
>>>> Are multiple channel{} commands processed in parallel or sequentially?
>>>>
>>>> Kr,
>>>>
>>>> James
>>>>
>>>>
>>>> On 9 May 2017 07:20:05 BST, "Scheidler, Balázs" <
>>>> balazs.scheidler at balabit.com> wrote:
>>>>>
>>>>> This is possible, but with quite ugly syntax. I always wanted to add
>>>>> some syntactic sugar, but never got around to do it.
>>>>>
>>>>> It looks like this:
>>>>>
>>>>> junction {
>>>>>    channel {
>>>>>        # if, with conditions specified as filters
>>>>>        filter { whatever... };
>>>>>        destination { whatever };
>>>>>        flags(final);
>>>>>     };
>>>>>     channel {
>>>>>        # else, you can add filters as well
>>>>>        destination { something else };
>>>>>        flags(final);
>>>>>     };
>>>>> };
>>>>>
>>>>> The key parts:
>>>>> * This can be embedded to any log statement as it is
>>>>> * It uses inline filters and destinations, but you can use other
>>>>> definitions by using simple parens instead of braces.
>>>>> * flags final which causes processing to be stopped at the first
>>>>> match. Without that, you'd be duplicating messages, if the conditions
>>>>> overlap.
>>>>> * You can add any number of channels, you are not limited to one
>>>>> if/else construct. It is more like a filter based switch with multple
>>>>> potential branches.
>>>>>
>>>>> Hope this helps,
>>>>>
>>>>>
>>>>> On May 9, 2017 01:03, "Jorge Pereira" <jpereiran at gmail.com> wrote:
>>>>>
>>>>>> Ops! The documentation explaining only to use with templates.
>>>>>>
>>>>>> Basically, I am looking for how to do the below pseudo-code.
>>>>>>
>>>>>>     destination {
>>>>>>         if ($R_MIN >= 0 && $R_MIN < 30)
>>>>>>             file("/path/file_00m-15m.log");
>>>>>>         else
>>>>>>             file("/path/file_30m-60m.log");
>>>>>>         endif()
>>>>>>     };
>>>>>>
>>>>>> p.s: I need to save the logs in chunks of 30 minutes being 00m-30m &
>>>>>> 31m-60m
>>>>>>
>>>>>> --
>>>>>> Jorge Pereira
>>>>>>
>>>>>> On Mon, May 8, 2017 at 7:52 PM, Jorge Pereira <jpereiran at gmail.com>
>>>>>> wrote:
>>>>>>
>>>>>>> never mind, I found it.
>>>>>>>
>>>>>>> https://www.balabit.com/documents/syslog-ng-ose-latest-guide
>>>>>>> s/en/syslog-ng-ose-guide-admin/html/reference-template-funct
>>>>>>> ions.html
>>>>>>>
>>>>>>> --
>>>>>>> Jorge Pereira
>>>>>>>
>>>>>>> On Mon, May 8, 2017 at 7:46 PM, Jorge Pereira <jpereiran at gmail.com>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> hi team,
>>>>>>>> is it possible to use if() ... else statements on syslog-ng 3.7? I
>>>>>>>> am trying to do something like.
>>>>>>>>
>>>>>>>> if ($value >= X)
>>>>>>>>   ......
>>>>>>>> else
>>>>>>>>   ......
>>>>>>>> --
>>>>>>>> Jorge Pereira
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> ____________________________________________________________
>>>>>> __________________
>>>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>>>> Documentation: http://www.balabit.com/support
>>>>>> /documentation/?product=syslog-ng
>>>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>>>
>>>>>>
>>>>>>
>>>> --
>>>> Sent from my Android device with K-9 Mail. Please excuse my brevity.
>>>>
>>>> ____________________________________________________________
>>>> __________________
>>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>>> Documentation: http://www.balabit.com/support
>>>> /documentation/?product=syslog-ng
>>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>>
>>>>
>>>>
>>>
>>> ____________________________________________________________
>>> __________________
>>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>>> Documentation: http://www.balabit.com/support
>>> /documentation/?product=syslog-ng
>>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>>
>>>
>>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170511/0ac5346a/attachment-0001.html>