diff options
Diffstat (limited to 'doc/property_replacer.html')
| -rw-r--r-- | doc/property_replacer.html | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html index f4c6bd64..10dba469 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -59,7 +59,9 @@ part of it. If you are using regular expressions, the property replacer will return the part of the property text that matches the regular expression. An
example for a property replacer sequence with a regular expression is: "%msg:R:.*Sev:.
\(.*\) \[.*--end%"<br>
-<br>
+<p>
+<b>Also, extraction can be done based on so-called "fields"</b>. To do so, place
a "F" into FromChar. A field in its current definition is anything that is
delemited by TAB characters (US-ASCII value 9). If your syslog data is tabular,
this is a quicker way to extract than via regular expressions (actually, a *much*
quicker way). Field counting starts at 1. Field zero is accepted, but will
always lead to a "field not found" error. The same happens if a field number
higher than the number of fields in the property is requested. The field number
must be placed in the "ToChar" parameter. An example where the 3rd field from
the msg property is extracted is as follows: "%msg:F:3%".<p>
+Please note that the special characters "F" and "R" are case-sensitive. Only
upper case works, lower case will return an error.<br>
<h2>Property Options</h2>
<b><code>property options</code></b> are case-insensitive. Currently, the following options
are defined:</p>
|