Expressions

Rsyslog supports expressions at a growing number of places. So far, they are supported for filtering messages.

Formal Definition

Below is the formal definition of expression format (in ABNF, RFC 2234):

if_stmt  := "if" expr "then"  # an aid, not part of expression itself

expr     := e_and *("or" e_and)
e_and    := e_cmp *("and" e_cmp)
e_cmp    := val 0*1(cmp_op val)
val      := ["+" / "-"] term *(("+" / "-") term)
term     := factor *(("*" / "/" / "%") factor)
factor   := ["not"] terminal
terminal := var / constant / function / "(" expr ")"
function := name "(" *("," expr) ")"
var      := "$" varname
varname  := msgvar / sysvar
msgvar   := name
sysvar   := "$" name
name     := alpha *(alnum)
constant := string / number
string   := simpstr / tplstr ; tplstr will be implemented in next phase
simpstr  := "'" *char "'"    ; use your imagination for char ;)
tplstr   := '"' template '"' ; not initially implemented
number   := 1*digit ; 0nn = octal, 0xnn = hex, nn = decimal
cmp_op   := "==" / "!=" / "<>" / "<" / ">" / "<=" / ">=" 
digit    := %x30-39
alpha    := "a" ... "z" # all letters
alnum    :* alpha / digit / "_"

[rsyslog.conf overview] [manual index] [rsyslog site]