From b4729996790c0f7a0b2758d9ee809b7cc10dec8f Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Mon, 10 Nov 2008 09:57:49 +0100
Subject: doc update: documented how to specify multiple property replacer
options
abd link to new online regex generator tool added
---
ChangeLog | 4 ++++
doc/manual.html | 1 +
doc/property_replacer.html | 11 +++++++++++
3 files changed, 16 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index a0542b56..688f2c99 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,8 @@
---------------------------------------------------------------------------
+Version 3.20.1 [v3-stable] (rgerhards), 2008-11-??
+- doc update: documented how to specify multiple property replacer
+ options + link to new online regex generator tool added
+---------------------------------------------------------------------------
Version 3.20.0 [v3-stable] (rgerhards), 2008-11-05
- this is the inital release of the 3.19.x branch as a stable release
- bugfix: double-free in pctp netstream driver. Thank to varmojfeko
diff --git a/doc/manual.html b/doc/manual.html
index cbb3477d..61b16527 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -35,6 +35,7 @@ the links below for the
- configuration file syntax (rsyslog.conf)
- property
replacer, an important core component
+- a regular expression checker/generator tool for rsyslog
- a commented sample
rsyslog.conf
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index 367c8add..0b4f1a01 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -231,6 +231,13 @@ the full field if no match is found:
%msg:R,ERE,1,FIELD:for (vlan[0-9]*):--end%
and this takes the first submatch of the second match of said expression:
%msg:R,ERE,1,FIELD,1:for (vlan[0-9]*):--end%
+
Please note: there is also a
+rsyslog regular expression checker/generator
+online tool available. With that tool, you can check your regular expressions and
+also generate a valid property replacer sequence. Usage of this tool is recommended.
+Depending on the version offered, the tool may not cover all subleties that can
+be done with the property replacer. It concentrates on the most often used cases. So it
+is still useful to hand-craft expressions for demanding environments.
Also, extraction can be done based on so-called
"fields". To do so, place a "F" into FromChar. A field in its
current definition is anything that is delimited by a delimiter
@@ -347,6 +354,10 @@ Useful for secure pathname generation (with dynafiles).
+
To use multiple options, simply place them one after each other with a comma delmimiting
+them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together,
+the last one will override the previous one. For example, using "escape-cc,drop-cc" will
+use drop-cc and "drop-cc,escape-cc" will use escape-cc mode.
Further Links