summaryrefslogtreecommitdiffstats
path: root/doc/property_replacer.html
diff options
context:
space:
mode:
authorRainer Gerhards <rgerhards@adiscon.com>2005-12-23 12:46:29 +0000
committerRainer Gerhards <rgerhards@adiscon.com>2005-12-23 12:46:29 +0000
commit271c0769b0375246014162b7a160118465c5bbfe (patch)
treefca77b56c60f78d22c014d698261f56e62b6398a /doc/property_replacer.html
parent69d0a13b86476fb476769a9901169af36b4b204b (diff)
downloadrsyslog-271c0769b0375246014162b7a160118465c5bbfe.tar.gz
rsyslog-271c0769b0375246014162b7a160118465c5bbfe.tar.xz
rsyslog-271c0769b0375246014162b7a160118465c5bbfe.zip
finalized field-support in property replacer (doc updated)
Diffstat (limited to 'doc/property_replacer.html')
-rw-r--r--doc/property_replacer.html4
1 files changed, 3 insertions, 1 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index f4c6bd64..10dba469 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -59,7 +59,9 @@ part of it. If you are using regular expressions, the property replacer will
return the part of the property text that matches the regular expression. An
example for a property replacer sequence with a regular expression is: &quot;%msg:R:.*Sev:.
\(.*\) \[.*--end%&quot;<br>
-<br>
+<p>
+<b>Also, extraction can be done based on so-called &quot;fields&quot;</b>. To do so, place a &quot;F&quot; into FromChar. A field in its current definition is anything that is delemited by TAB characters (US-ASCII value 9). If your syslog data is tabular, this is a quicker way to extract than via regular expressions (actually, a *much* quicker way). Field counting starts at 1. Field zero is accepted, but will always lead to a &quot;field not found&quot; error. The same happens if a field number higher than the number of fields in the property is requested. The field number must be placed in the &quot;ToChar&quot; parameter. An example where the 3rd field from the msg property is extracted is as follows: &quot;%msg:F:3%&quot;.<p>
+Please note that the special characters &quot;F&quot; and &quot;R&quot; are case-sensitive. Only upper case works, lower case will return an error.<br>
<h2>Property Options</h2>
<b><code>property options</code></b> are case-insensitive. Currently, the following options
are defined:</p>