| Synopsis: |
level(<priority-level>) or level(<priority-level>..<priority-level>) |
Description: The level() filter selects messages corresponding to a single importance level, or a level-range. To select messages of a specific level, use the name of the level as a filter parameter, for example, use the following to select warning messages:
level(warning)
To select a range of levels, include the beginning and the ending level in the filter, separated with two dots (..). For example, to select every message of error or higher level, use the following filter:
level(err..emerg)
The level() filter accepts the following levels: emerg, alert, crit, err, warning, notice, info, debug.
| Synopsis: |
match(regexp) | match(regexp value("MACRO")) | match(regexp template("MACROS")) |
Description: Match a regular expression to the headers and the message itself (that is, the values returned by the MSGHDR and MSG macros). Note that in syslog-ng version 2.1 and earlier, the match() filter was applied only to the text of the message, excluding the headers. This functionality has been moved to the message() filter.
To limit the scope of the match to a specific part of the message (identified with a macro), use the match(regexp value("MACRO")) syntax. Do not include the $ sign in the parameter of the value() option.
The value() parameter accepts both built-in macros and user-defined ones created with a parser or using a pattern database. For details on macros and parsers, see Templates and macros, Parsing messages with comma-separated and similar values, and Using parser results in filters and templates.
Starting with version 3.22, the match() filter can work on templates as well. This means that you can a match against an expression combined of macros, instead of a single macro. Note that when using a template, you must reference macros with the $ sign (unlike when using the value() parameter). For example:
match("^my-regular-expression" template("${HOST}|${PROGRAM}${PID}|${MESSAGE}"));
Using a template with a single macro is equivalent with using the value() parameter. For example, the following two lines are equivalent:
match("^my-regular-expression" value("MESSAGE"));
match("^my-regular-expression" template("${MESSAGE}"));
| Synopsis: |
message(regexp) |
Description: Match a regular expression to the text of the log message, excluding the headers (that is, the value returned by the MSG macros). Note that in syslog-ng version 2.1 and earlier, this functionality was performed by the match() filter.
| Synopsis: |
netmask(ipv4/mask) |
Description: Select only messages sent by a host whose IP address belongs to the specified IPv4 subnet. Note that this filter checks the IP address of the last-hop relay (the host that actually sent the message to syslog-ng OSE), not the contents of the HOST field of the message. You can use both the dot-decimal and the CIDR notation to specify the netmask. For example, 192.168.5.0/255.255.255.0 or 192.168.5.0/24. To filter IPv6 addresses, see netmask6().
