Say I want to filter logs to use different files per user ID, I can write one rule per uid as here :

if $msg contains 'uid=500' then /var/log/uid/500
if $msg contains 'uid=501' then /var/log/uid/501
if $msg contains 'uid=502' then /var/log/uid/502

I would like to write one single line by using a regexp capture like this:

if $msg contains 'uid=\([0-9]+\)' then /var/log/uid/\1

Is it possible and how please?


You can do this using a property replacer. Put in your rsyslog.conf or similar a line defining a template that is the desired format of the filename, and use it in the action when you match the input line. For example,

$template myfile,"/var/log/uid/%msg:R,ERE,1,FIELD:.*?uid=([0-9]+).*--end%"
if (re_match($msg, "uid=[0-9]+")) then {
 action(type="omfile" dynaFile="myfile")

The template says the template variable myfile is the string including the msg property replaced by a regex (R) match, extended (ERE), group capture 1 (1), (and if no match, keep the original FIELD). The actual regex is the .*?uid=([0-9]+).* part. The --end is an obligatory part of the %...:R,...--end% sequence.

The lines following are the usual Rainer Script test for the lines you want to match, and where to place the result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.