CODEWITHSUNDEEP
regexsyslog
fresh
fresh

Reputation: 93

Regex in syslog template

I try to use regex in a syslog template but it still not works. I first tried do match everthing to see if it works but it dont works. I tested my expression with a online tool and there it works. In my opinion the log message should be empty because the expression always match or? But there are always zeros in the log file.

template(name="testLogFormat" type="list")
   property(name="syslogtag"
            regex.type="ERE"
            regex.submatch="0"
            regex.expression=".*--end"
            regex.nomatchmode="ZERO"
)

Upvotes: 1

Views: 3500

Answers (1)

Wiktor Stribiżew
Wiktor Stribiżew

Reputation: 626738

Your input string looks like abc[123]. So, you may fix your current config using

regex.submatch="1"
regex.expression="\[([0-9]+)]"

See the regex demo.

Here,

  • \[ - matches a [
  • ([0-9]+) - captures into Group 1 (you access the value using regex.submatch="1")
  • ] - a closing ].

Upvotes: 1

Related Questions