issu with regxp rsyslog

Asked Sep 29 '16 at 09:55

Active Sep 29 '16 at 10:04

Viewed 48 times

i have this logs

**[06/Aug/2016: 11:47:28 +0200]** [ Warning. Match of "rx \\.(jpg)$" against "REQUEST_FILENAME" required. [file "/mod_security2/modsecurity.conf"] [line "29"] [id "980"] **[msg "USER_ACTIONS_TRACKING (tablecolspan=2&CSRF_TOKEN=-4492965027555802&accessType="]**

ineed to extract only this two field [06/Aug/2016: 11:47:28 +0200] and [msg.....] the new line of log will be date +msg

i used this rules \[.*\+/d{4}\]\[(msg).*\] but it dosent work. can you help me please thanks in advance

edited Sep 29 '16 at 10:04

asked Sep 29 '16 at 09:55

user2148747

Try [`\[[^\]\[]*\+\d{4}\]|\[msg[^\]\[]*\]`](https://regex101.com/r/ifD4b7/1) – Wiktor Stribiżew Sep 29 '16 at 09:58
i used this website http://www.rsyslog.com/regex/ and it dosent work – user2148747 Sep 29 '16 at 10:02
Yes, because that is POSIX ERE. Try `\[[^][]*[+][0-9]{4}]|\[msg[^][]*]`. Not sure, but you might need to split the regex and use `\[[^][]*[+][0-9]{4}]` and `\[msg[^][]*]` separately. – Wiktor Stribiżew Sep 29 '16 at 10:04
how can i do it separately? because i will send tis line of logs to other file log – user2148747 Sep 29 '16 at 10:11
No idea how to make this fetch multiple matches, nor access 2 captured values in 1 match. See related http://stackoverflow.com/questions/29111248/regular-expression-multiple-matches thread. – Wiktor Stribiżew Sep 29 '16 at 10:15
have you please other solution than regexp? to send line logs withe these two values in one match in real time to other file log – user2148747 Sep 29 '16 at 10:53

issu with regxp rsyslog

0 Answers0