Starting with syslog-ng OSE version 3.2, it is also possible to compare macro values and templates as numerical and string values. String comparison is alphabetical: it determines if a string is alphabetically greater or equal to another string. Use the following syntax to compare macro values or templates. For details on macros and templates, see Customize message format using macros and templates.
filter <filter-id>
{"<macro-or-template>" operator "<value-or-macro-or-template>"};
Example: Comparing macro values in filters
The following expression selects log messages containing a PID (that is, ${PID} macro is not empty):
filter f_pid {"${PID}" !=""};
The following expression selects log messages that do not contain a PID. Also, it uses a template as the left argument of the operator and compares the values as strings:
filter f_pid {"${HOST}${PID}" eq "${HOST}"};
The following example selects messages with priority level higher than 5.
filter f_level {"${LEVEL_NUM}" > "5"};
Note that:
-
The macro or template must be enclosed in double-quotes.
-
The $ character must be used before macros.
-
Using comparator operators can be equivalent to using filter functions, but is somewhat slower. For example, using "${HOST}" eq "myhost" is equivalent to using host("myhost" type(string)).
-
You can use any macro in the expression, including user-defined macros from parsers and results of pattern database classifications.
-
The results of filter functions are boolean values, so they cannot be compared to other values.
-
You can use boolean operators to combine comparison expressions.
The following operators are available:
Table 12: Numerical and string comparison operators
| == |
eq |
Equals |
| != |
ne |
Not equal to |
| > |
gt |
Greater than |
| < |
lt |
Less than |
| >= |
ge |
Greater than or equal |
| =< |
le |
Less than or equal |
The host(), match(), and program() filter functions accept regular expressions as parameters. The exact type of the regular expression to use can be specified with the type() option. By default, syslog-ng OSE uses PCRE regular expressions.
In regular expressions, the asterisk (*) character means 0, 1, or any number of the previous expression. For example, in the f*ilter expression the asterisk means 0 or more f letters. This expression matches for the following strings: ilter, filter, ffilter, and so on. To achieve the wildcard functionality commonly represented by the asterisk character in other applications, use .* in your expressions, for example, f.*ilter.
Alternatively, if you do not need regular expressions, only wildcards, use type(glob) in your filter:
Example: Filtering with widcards
The following filter matches on hostnames starting with the myhost string, for example, on myhost-1, myhost-2, and so on.
filter f_wildcard {host("myhost*" type(glob));};
For details on using regular expressions in syslog-ng OSE, see Using wildcards, special characters, and regular expressions in filters.
To filter for special control characters like the carriage return (CR), use the \r escape prefix in syslog-ng OSE version 3.0 and 3.1. In syslog-ng OSE 3.2 and later, you can also use the \x escape prefix and the ASCII code of the character. For example, to filter on carriage returns, use the following filter:
filter f_carriage_return {match("\x0d" value ("MESSAGE"));};
You can label the messages with custom tags. Tags are simple labels, identified by their names, which must be unique. Currently syslog-ng OSE can tag a message at two different places:
When syslog-ng receives a message, it automatically adds the .source.<id_of_the_source_statement> tag to the message. Use the tags() option of the source to add custom tags, and the tags() option of the filters to select only specific messages.
-
Tagging messages and also filtering on the tags is very fast, much faster than other types of filters.
-
Tags are available locally, that is, if you add tags to a message on the client, these tags will not be available on the server.
-
To include the tags in the message, use the ${TAGS} macro in a template. Alternatively, if you are using the IETF-syslog message format, you can include the ${TAGS} macro in the .SDATA.meta part of the message. Note that the ${TAGS} macro is available only in syslog-ng OSE 3.1.1 and later.
For an example on tagging, see Example: Adding tags and filtering messages with tags.
The following functions may be used in the filter statement, as described in Filters.
Table 13: Filter functions available in syslog-ng OSE
| facility() |
Filter messages based on the sending facility. |
| filter() |
Call another filter function. |
| host() |
Filter messages based on the sending host. |
| in-list() |
File-based whitelisting and blacklisting. |
| level() or priority() |
Filter messages based on their priority. |
| match() |
Use a regular expression to filter messages based on a specified header or content field. |
| message() |
Use a regular expression to filter messages based on their content. |
| netmask() or netmask6() |
Filter messages based on the IP address of the sending host. |
| program() |
Filter messages based on the sending application. |
| rate-limit() |
Limits messages rate based on arbitrary keys in each message. |
| source() |
Select messages of the specified syslog-ng OSE source statement. |
| tags() |
Select messages having the specified tag. |
