This is the multi-page printable view of this section.
Click here to print.
Return to the regular view of this page.
Options of regular expressions
This chapter lists regular expressions supported by AxoSyslog and their available supported type()
and flags()
options.
By default, AxoSyslog uses PCRE-style regular expressions. To use other expression types, add the type()
option after the regular expression.
The AxoSyslog application supports the following regular expression type()
options:
1 - The type() options of regular expressions
By default, AxoSyslog uses PCRE-style regular expressions, which are supported on every platform starting with AxoSyslog version 3.1. To use other expression types, add the type()
option after the regular expression.
The AxoSyslog application supports the following type()
options:
Perl Compatible Regular Expressions (pcre)
Description: Uses Perl Compatible Regular Expressions (PCRE). If the type()
parameter is not specified, AxoSyslog uses PCRE regular expressions by default.
For more information about the flags()
options of PCRE regular expressions, see The flags() options of regular expressions.
Literal string searches (string)
Description: Matches the strings literally, without regular expression support. By default, only identical strings are matched. For partial matches, use the flags("prefix")
or the flags("substring")
flags.
For more information about the flags()
options of literal string searches, see The flags() options of regular expressions.
Glob patterns without regular expression support (glob)
Description: Matches the strings against a pattern containing \*
and ?
wildcards, without regular expression and character range support. The advantage of glob patterns to regular expressions is that globs can be processed much faster.
-
\*
: matches an arbitrary string, including an empty string
-
?
: matches an arbitrary character
-
The wildcards can match the /
character.
-
You cannot use the \*
and ?
literally in the pattern.
2 - The flags() options of regular expressions
Similarly to the type()
options, the flags()
options are also optional within regular expressions.
The following list describes each type()
option’s flags()
options.
2.1 - Perl Compatible Regular Expressions (PCRE)
Starting with AxoSyslog version 3.1, PCRE expressions are supported on every platform. If the type()
parameter is not specified, AxoSyslog uses PCRE regular expressions by default.
The following example shows the structure of PCRE-style regular expressions in use.
Example: Using PCRE regular expressions
rewrite r_rewrite_subst {
subst("a*", "?", value("MESSAGE") flags("utf8" "global"));
};
PCRE-style regular expressions have the following flags()
options:
disable-jit
Switches off the just-in-time compilation function for PCRE regular expressions.
dupnames
Allows using duplicate names for named subpatterns.
Configuration example:
filter { match("(?<DN>foo)|(?<DN>bar)" value(MSG) flags(store-matches, dupnames)); };
...
destination { file(/dev/stdout template("$DN\n")); };
global
Usable only in rewrite rules, flags("global")
matches for every occurrence of the expression, not only the first one.
ignore-case
Disables case-sensitivity.
newline
When configured, it changes the newline definition used in PCRE regular expressions to accept either of the following:
- a single carriage-return
- linefeed
- the sequence carriage-return and linefeed (
\\r
, \\n
and \\r\\n
, respectively)
This newline definition is used when the circumflex and dollar patterns (^
and $
) are matched against an input. By default, PCRE interprets the linefeed character as indicating the end of a line. It does not affect the \\r
, \\n
or \\R
characters used in patterns.
store-matches
Stores the matches of the regular expression into the $0, ... $255
variables. The $0
stores the entire match, $1
is the first group of the match (parentheses), and so on. Named matches (also called named subpatterns), for example, (?<name>...)
, are stored as well. Matches from the last filter expression can be referenced in regular expressions.
Note
To convert match variables into a AxoSyslog list, use the
$\*
macro, which can be further manipulated using
List manipulation, or turned into a list in type-aware destinations.
unicode
Uses Unicode support for UTF-8 matches: UTF-8 character sequences are handled as single characters.
utf8
An alias for the unicode
flag.
2.2 - Literal string searches
Literal string searches have the following flags()
options:
global
Usable only in rewrite rules, flags("global")
matches for every occurrence of the expression, not only the first one.
ignore-case
Disables case-sensitivity.
prefix
During the matching process, patterns (also called search expressions) are matched against the input string starting from the beginning of the input string, and the input string is matched only for the maximum character length of the pattern. The initial characters of the pattern and the input string must be identical in the exact same order, and the pattern’s length is definitive for the matching process (that is, if the pattern is longer than the input string, the match will fail).
Example: matching / non-matching patterns for the input string ’exam'
For the input string 'exam'
,
store-matches
Stores the matches of the regular expression into the $0, ... $255
variables. The $0
stores the entire match, $1
is the first group of the match (parentheses), and so on. Named matches (also called named subpatterns), for example, (?<name>...)
, are stored as well. Matches from the last filter expression can be referenced in regular expressions.
Note
To convert match variables into a AxoSyslog list, use the
$\*
macro, which can be further manipulated using
List manipulation, or turned into a list in type-aware destinations.
substring
The given literal string will match when the pattern is found within the input. Unlike flags("prefix")
, the pattern does not have to be identical with the given literal string.
2.3 - Glob patterns without regular expression support
There are no supported flags()
options for glob patterns without regular expression support.