From 1d97cb00bdb349e3d7b275607f3d31a61abdf02e Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 10 Sep 2008 12:29:44 +0200 Subject: added doc for new property replacer feature (see previous commit) --- doc/property_replacer.html | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 367c8add..ad3ae552 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -250,8 +250,30 @@ same example with semicolon as delimiter is "%msg:F,59:3%".

Please note that the special characters "F" and "R" are case-sensitive. Only upper case works, lower case will return an error. There are no white spaces permitted inside the sequence (that will lead -to error messages and will NOT provide the intended result).
+to error messages and will NOT provide the intended result).

+

Each occurence of the field delimiter starts a new field. However, +if you add a plus sign ("+") after the field delimiter, multiple +delimiters, one immediately after the others, are treated as separate +fields. This can be useful in cases where the syslog message contains +such sequences. A frequent case may be with code that is written as +follows:

+
+int n, m;
+...
+syslog(LOG_ERR, "%d test %6d", n, m);
+
 +

This will result into things like this in syslog messages: +"1 test      2", +"1 test     23", +"1 test  234567" +

As you can see, the fields are delimited by space characters, but +their exact number is unknown. They can properly be extracted as follows: +

+"%msg:F,32:2%" to "%msg:F,32+:2%". +

This feature was suggested by Zhuang Yuyao and implemented by him. +It is modeled after perl compatible regular expressions.

+

Property Options

property options are case-insensitive. Currently, the following options are defined: -- cgit