0

I'm looking for a way to write a single rule with multiple match values, don't write those rows to logfile if the message contain first word or second word.

This works but isn't DRY:

if $msg contains "WARNING:" then { Action (type="omfile" File="/var/log/ignorethis") stop }
if $msg contains "IGNORE THIS MESSAGE:" then { Action (type="omfile" File="/var/log/ignorethis") stop }

this one doesn't work:

if $msg contains "WARNING: || IGNORE THIS MESSAGE:" then { Action (type="omfile" File="/var/log/ignorethis") stop }
Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47
user2239318
  • 131
  • 7

1 Answers1

0

Does this work?

if ($msg contains "WARNING:") or ($msg contains "IGNORE THIS MESSAGE:") then { Action (type="omfile" File="/var/log/ignorethis") stop }

The rsyslog expression documentation may help a little.

Andrew Schulman
  • 8,811
  • 21
  • 32
  • 47