[syslog-ng] Regular expressions in rewrite

[Fabien Wernli]

On Fri, Aug 02, 2019 at 01:40:13PM +0000, Faine, Mark R. (MSFC-IS40)[NICS] wrote:
> Is there a way to use regular expressions when setting a value in a rewrite rule?
[...]
> But without changing the actual log message.  The goal is to create a variable from a regular expression of the host field in the message that I can then use in a destination path.

You could copy the content of HOST into another macro, then use subst on the
copy:

  rewrite r_rewrite_set_host{
    set("$HOST", value("copy_of_host"));
    subst("^[a-z]+\-([a-z]+).*$", "$1", value("copy_of_host"));
    set("$copy_of_host" value("location")
      condition(
        filter(f_filter_hostnames)
      )
    );
    unset('copy_of_host');
  }

Note that you could also use named matches in subst:

  subst("^[a-z]+\-(?<location>[a-z]+).*$", "$1", value("copy_of_host"));