Expressions

Rsyslog supports expressions at a growing number of places. So far, they are supported for filtering messages.

C-like comments (/* some comment */) are supported inside the expression, but not yet in the rest of the configuration file.

Formal Definition

Below is the formal definition of expression format (in ABNF, RFC 2234):

; The stuff immediately below here is a quick shot at how the config
; file ABNF *at whole* may look like. That is not really related to
; expressions, but for the time being I put it here. It will later be
; moved to a more appropriate place. -- rgerhards, 2008-02-22
if_stmt  := "if" expr "then"

; and now the actual expression
expr     := e_and *("or" e_and)
e_and    := e_cmp *("and" e_cmp)
e_cmp    := val 0*1(cmp_op val)
val      := term *(("+" / "-") term)
term     := factor *(("*" / "/" / "%") factor)
factor   := ["not"] ["-"] terminal
terminal := var / constant / function / ( "(" expr ")" )
function := name "(" *("," expr) ")"
var      := "$" varname
varname  := msgvar / sysvar
msgvar   := name
sysvar   := "$" name
name     := alpha *(alnum)
constant := string / number
string   := simpstr / tplstr ; tplstr will be implemented in next phase
simpstr  := "'" *char "'"    ; use your imagination for char ;)
tplstr   := '"' template '"' ; not initially implemented
number   := ["-"] 1*digit ; 0nn = octal, 0xnn = hex, nn = decimal
cmp_op   := "==" / "!=" / "<>" / "<" / ">" / "<=" / ">=" / "contains" / "startswith"
digit    := %x30-39
alpha    := "a" ... "z" # all letters
alnum    :* alpha / digit / "_"

[rsyslog.conf overview] [manual index] [rsyslog site]