Expressions

Rsyslog supports expressions at a growing number of places. So far, they are supported for filtering messages.

Formal Definition

Below is the formal definition of expression format (in ABNF, RFC 2234):

expr     := e_and *("or" e_and)
e_and := e_cmp *("and" e_cmp)
e_cmp := val cmp_op val
val := ["+" / "-"] term *(("+" / "-") term)
term := factor *(("*" / "/" / "%") factor)
factor := ["not"] terminal
terminal := var / constant / function / "(" expr ")"
function := name "(" *("," expr) ")"
var := "$" varname
varname := msgvar / sysvar
msgvar := name
sysvar := "$" name
name := alpha *(alnum)
constant := string / number
string := simpstr / tplstr ; tplstr will be implemented in next phase
simpstr := "'" *char "'" ; use your imagination for char ;)
tplstr := '"' template '"' ; not initially implemented
number := 1*digit ; 0nn = octal, 0xnn = hex, nn = decimal
cmp_op := "==" / "!=" / "<>" / "<" / ">" / "<=" / ">="
digit := %x30-39
alpha := "a" ... "z" # all letters
alnum :* alpha / digit / "_"

[rsyslog.conf overview] [manual index] [rsyslog site]

This documentation is part of the rsyslog project.
Copyright © 2008 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.