diff options
author | Rainer Gerhards <rgerhards@adiscon.com> | 2012-04-27 09:55:11 +0200 |
---|---|---|
committer | Rainer Gerhards <rgerhards@adiscon.com> | 2012-04-27 09:55:11 +0200 |
commit | 9801893b29ea47ade4b915e3eac79bcdc5ce74aa (patch) | |
tree | 305e277ab9faa5941d151eae68f5d04fc41e9129 /doc | |
parent | fb5cd633e6f4852841354fcf55c971063cc6a871 (diff) | |
parent | 9c76723c5b048afe4009f0528a6201741fec234a (diff) | |
download | rsyslog-9801893b29ea47ade4b915e3eac79bcdc5ce74aa.tar.gz rsyslog-9801893b29ea47ade4b915e3eac79bcdc5ce74aa.tar.xz rsyslog-9801893b29ea47ade4b915e3eac79bcdc5ce74aa.zip |
Merge branch 'v5-stable-field-substring' into v5-beta
Diffstat (limited to 'doc')
-rw-r--r-- | doc/omudpspoof.html | 20 | ||||
-rw-r--r-- | doc/property_replacer.html | 9 |
2 files changed, 19 insertions, 10 deletions
diff --git a/doc/omudpspoof.html b/doc/omudpspoof.html index 16cb9b13..df14bbe1 100644 --- a/doc/omudpspoof.html +++ b/doc/omudpspoof.html @@ -16,7 +16,7 @@ spoof the sender address. Also, it enables to circle through a number of source ports. <p><b>Configuration Directives</b>:</p> <ul> -<li><b>$ActionOMUDPSpoofSourceNameTemplate</b> <templatename><br> +<li><b>$ActionOMOMUDPSpoofSourceNameTemplate</b> <templatename><br> This is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the @@ -28,7 +28,7 @@ So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case. <li><b>$ActionOMUDPSpoofTargetHost</b> <hostname><br> Host that the messages shall be sent to. -<li><b>$ActionUDPSpoofTargetPort</b> <port><br> +<li><b>$ActionOMUDPSpoofTargetPort</b> <port><br> Remote port that the messages shall be sent to. <li><b>$ActionOMUDPSpoofDefaultTemplate</b> <templatename><br> This setting instructs omudpspoof to use a template different from the @@ -53,7 +53,7 @@ care about the source port. This example is considered the typical use case for omudpspoof. </p> <textarea rows="5" cols="80">$ModLoad omudpspoof -$ActionUDPSpoofTargetHost server.example.com +$ActionOMUDPSpoofTargetHost server.example.com *.* :omudpspoof: </textarea> @@ -64,10 +64,10 @@ source port 514 is used. <textarea rows="8" cols="80">$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" $template spooftemplate,"%rawmsg%" -$ActionUDPSpoofSourceNameTemplate spoofaddr -$ActionUDPSpoofTargetHost server.example.com -$ActionUDPSpoofSourcePortStart 514 -$ActionUDPSpoofSourcePortEnd 514 +$ActionOMUDPSpoofSourceNameTemplate spoofaddr +$ActionOMUDPSpoofTargetHost server.example.com +$ActionOMUDPSpoofSourcePortStart 514 +$ActionOMUDPSpoofSourcePortEnd 514 *.* :omudpspoof:;spooftemplate </textarea> <p>The following sample is similar to the previous, but uses as many defaults as possible. @@ -77,8 +77,8 @@ have been changed, the previously set defaults will be used! </p> <textarea rows="5" cols="80">$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" -$ActionUDPSpoofSourceNameTemplate spoofaddr -$ActionUDPSpoofTargetHost server.example.com +$ActionOMUDPSpoofSourceNameTemplate spoofaddr +$ActionOMUDPSpoofTargetHost server.example.com *.* :omudpspoof: </textarea> <p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] @@ -86,7 +86,7 @@ $ActionUDPSpoofTargetHost server.example.com <p><font size="2">This documentation is part of the <a href="http://www.rsyslog.com/">rsyslog</a> project.<br> -Copyright © 2009 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and +Copyright © 2009-2012 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and <a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL version 3 or higher.</font></p> </body></html> diff --git a/doc/property_replacer.html b/doc/property_replacer.html index f0153f2a..5dbdc4c6 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -274,6 +274,15 @@ fields in the property is requested. The field number must be placed in the "ToChar" parameter. An example where the 3rd field (delimited by TAB) from the msg property is extracted is as follows: "%msg:F:3%". The same example with semicolon as delimiter is "%msg:F,59:3%".</p> +<p>The use of fields does not permit to select substrings, what is rather +unfortunate. To solve this issue, starting with 6.3.9, fromPos and toPos +can be specified for strings as well. However, the syntax is quite ugly, but +it was the only way to integrate this functonality into the already-existing +system. To do so, use ",fromPos" and ",toPos" during field extraction. +Let's assume you want to extract the substring from position 5 to 9 in the previous +example. Then, the syntax is as follows: "%msg:F,59,5:3,9%". As you can see, +"F,59" means field-mode, with semicolon delimiter and ",5" means starting +at position 5. Then "3,9" means field 3 and string extraction to position 9. <p>Please note that the special characters "F" and "R" are case-sensitive. Only upper case works, lower case will return an error. There are no white spaces permitted inside the sequence (that will lead |