[syslog-ng] Regular expressions in rewrite

[Faine, Mark R. (MSFC-IS40)[NICS]]

Is there a way to use regular expressions when setting a value in a rewrite rule?

Something like:

rewrite r_rewrite_set_host{
  subst("^[a-z]+\-([a-z]+).*$", "$1", value("HOST"));
  set("HOST" value("location")
    condition(
      filter(f_filter_hostnames)
    )
  );
};

But without changing the actual log message.  The goal is to create a variable from a regular expression of the host field in the message that I can then use in a destination path.

Thanks,
-Mark

Mark Faine
System Administrator
SAIC/NICS
215 Wynn Dr. 5065
Huntsville, AL 35805
256-961-1295 (Desk)
256-617-4861 (Work Cell)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190802/09a9f062/attachment.html>