Return
-
Title
Forwarding filter doesn't work match("]\\s" value("MESSAGE")); -
Description
Forwarding filter doesn't work match("]\\s" value("MESSAGE")); -
Cause
Search queries apply the rules and syntax of regular expressions, syslog-ng does not govern the methods how these queries are interpreted.
Syslog-ng primarily uses POSIX Extended Regular Expressions (ERE).
In some cases if the syslog-ng configuration is done as per the admin guide using "" (double quotes) the filtering won't work as expected.
-
Resolution
When regular expression search queries are used with syslog-ng eg. in match() function use single quotes, instead of double quotes, to wrap the search expression.
Some regular expression queries will be working with either double or single quotes depening on the needs of the query. If user experiences problems with the expression as the first step attempt to run the query with different quotes.