When creating the aggregated message, or in the various parameters of the grouping-by()
parser, you can also refer to fields and values of earlier messages of the context by adding the @<distance-of-referenced-message-from-the-current>
suffix to the macro. For example, if there are three log messages in a context, the ${HOST}@1
expression refers to the host field of the current (third) message in the context, the ${HOST}@2
expression refers to the host field of the previous (second) message in the context, ${PID}@3
to the PID of the first message, and so on. For example, the following message can be created from SSH login/logout messages: An SSH session for ${SSH_USERNAME}@1 from ${SSH_CLIENT_ADDRESS}@2 closed. Session lasted from ${DATE}@2 to ${DATE}
.
${PID}@3
. The reference will not work if you omit the braces.
@
character in a template, use @@
.
Example: Referencing values from an earlier message
The following action can be used to log the length of an SSH session (the time difference between a login and a logout message in the context):
aggregate(
value('value name="MESSAGE" An SSH session for ${SSH_USERNAME}@1 from ${SSH_CLIENT_ADDRESS}@2 closed. Session lasted from ${DATE}@2 to ${DATE}')
)
For another example, see The grouping-by() parser in syslog-ng blog post
If you do not know in which message of the context contains the information you need, you can use the grep
template function. For details, see grep.
Example: Using the grep template function
The following example selects the message of the context that has a username
name-value pair with the root
value, and returns the value of the auth_method
name-value pair.
$(grep ("${username}" == "root") ${auth_method})
To perform calculations on fields that have numerical values, see Numerical operations.