Expressions

Rsyslog supports expressions at a growing number of places. So far, they are supported for filtering messages.

C-like comments (/* some comment */) are supported inside the expression, but not yet in the rest of the configuration file.

Formal Definition

Below is the formal definition of expression format (in ABNF, RFC 2234):

; The stuff immediately below here is a quick shot at how the config
; file ABNF *at whole* may look like. That is not really related to
; expressions, but for the time being I put it here. It will later be
; moved to a more appropriate place. -- rgerhards, 2008-02-22
?line?   := cfsysline / cfli
cfsysline:= BOL "$" *char EOL ; how to handle the first line? (no EOL in front!)
BOL      := ; Begin of Line - implicitely set on file beginning and after each EOL
EOL       := 0x0a ;LF
if_stmt  := "if" expr "then"
old_filter:= BOL facility "." severity ; no whitespace allowed between BOL and facility!
facility := "*" / "auth" / "authpriv" / "cron" / "daemon" / "kern" / "lpr" / 
            "mail" / "mark" / "news" / "security" / "syslog" / "user" / "uucp" / 
            "local0" .. "local7" / "mark"
	   ; The keyword security should not be used anymore
	   ; mark is just internal
severity := TBD ; not really relevant in this context

; and now the actual expression
expr     := e_and *("or" e_and)
e_and    := e_cmp *("and" e_cmp)
e_cmp    := val 0*1(cmp_op val)
val      := term *(("+" / "-") term)
term     := factor *(("*" / "/" / "%") factor)
factor   := ["not"] ["-"] terminal
terminal := var / constant / function / ( "(" expr ")" )
function := name "(" *("," expr) ")"
var      := "$" varname
varname  := msgvar / sysvar
msgvar   := name
sysvar   := "$" name
name     := alpha *(alnum)
constant := string / number
string   := simpstr / tplstr ; tplstr will be implemented in next phase
simpstr  := "'" *char "'"    ; use your imagination for char ;)
tplstr   := '"' template '"' ; not initially implemented
number   := ["-"] 1*digit ; 0nn = octal, 0xnn = hex, nn = decimal
cmp_op   := "==" / "!=" / "<>" / "<" / ">" / "<=" / ">=" / "contains" / "startswith"
digit    := %x30-39
alpha    := "a" ... "z" # all letters
alnum    :* alpha / digit / "_"

[rsyslog.conf overview] [manual index] [rsyslog site]