summaryrefslogtreecommitdiffstats
path: root/doc/rainerscript.html
diff options
context:
space:
mode:
authorRainer Gerhards <rgerhards@adiscon.com>2013-02-10 12:42:25 +0100
committerRainer Gerhards <rgerhards@adiscon.com>2013-02-10 12:42:25 +0100
commit2da01aa019afdcacbed7cb08f41f72fc7482f0ab (patch)
tree251fc525bd92de82956243e5948f5c499f5323e3 /doc/rainerscript.html
parent0f051ac6fc85cb4be725eba0723c9aff7ec425d7 (diff)
downloadrsyslog-2da01aa019afdcacbed7cb08f41f72fc7482f0ab.tar.gz
rsyslog-2da01aa019afdcacbed7cb08f41f72fc7482f0ab.tar.bz2
rsyslog-2da01aa019afdcacbed7cb08f41f72fc7482f0ab.zip
field() function now supports a string as field delimiter
also done a bugfix: field() function did never return "***FIELD NOT FOUND***" instead it returned "***ERROR in field() FUNCTION***" in that case
Diffstat (limited to 'doc/rainerscript.html')
-rw-r--r--doc/rainerscript.html14
1 files changed, 12 insertions, 2 deletions
diff --git a/doc/rainerscript.html b/doc/rainerscript.html
index c9f00386..d76316ed 100644
--- a/doc/rainerscript.html
+++ b/doc/rainerscript.html
@@ -67,10 +67,20 @@ variable, if it exists. Returns an empty string if it does not exist.
<li>cnum(expr) - converts expr to a number (integer)
<li>re_match(expr, re) - returns 1, if expr matches re, 0 otherwise
<li>field(str, delim, matchnbr) - returns a field-based substring. str is the string
-to search, delim is the numerical ascii value of the field delimiter (so that
-non-printable characters can by specified) and matchnbr is the match to search
+to search, delim is the delimiter and matchnbr is the match to search
for (the first match starts at 1). This works similar as the field based
property-replacer option.
+Versions prior to 7.3.7 only support a single character as delimiter character.
+Starting with version 7.3.7, a full string can be used as delimiter. If a single
+character is being used as delimiter, delim is the numerical ascii value of the
+field delimiter character (so that non-printable characters can by specified). If a
+string is used as delmiter, a multi-character string (e.g. "#011") is to be
+specified. Samples:<br>
+set $!usr!field = field($msg, 32, 3); -- the third field, delimited by space<br>
+set $!usr!field = field($msg, "#011", 3); -- the third field, delmited by "#011"<br>
+Note that when a single character is specified as string [field($msg, ",", 3)] a
+string-based extraction is done, which is more performance intense than the
+equivalent single-character [field($msg, 44 ,3)] extraction.
<li>prifilt(constant) - mimics a traditional PRI-based filter (like "*.*" or
"mail.info"). The traditional filter string must be given as a <b>constant string</b>.
Dynamic string evaluation is not permitted (for performance reasons).