0

I'm trying to write rsyslog messages received from a specific host to a log file based on the message content. Let's say I'd like to send messages received from "myserver" that contains the pattern "supertext\d{1,4}" to /var/log/myserver-supertext.log, I'd go with:

if $fromhost=='myserver' AND $msg contains 'supertext\d{1,4}' then /var/log/myserver-supertext.log
& stop

Unfortunately, expression-based filters in rsyslog do not seem to support regexp, and I was trying to figure out how to do the same thing with property based filters, which support regexp. I was thinking about something like:

:fromhost, isequal, "myserver" AND :msg, regex, "supertext\d{1,4}" /var/log/myserver-supertext.log
& stop

I know it doesn't work that way and I'll appreciate it if you have an idea on how to do it.

Dave M
  • 4,514
  • 22
  • 31
  • 30
Toyjo123
  • 1

1 Answers1

0

Not positive but it seems you need to use $msg contains 'supertext[0-9]{1,4}'

This passes syntax.

miken32
  • 942
  • 1
  • 13
  • 35
ATP
  • 26
  • 3