Perl Compatible Regular Expressions (PCRE)
Starting with AxoSyslog version 3.1, PCRE expressions are supported on every platform. If the type()
parameter is not specified, AxoSyslog uses PCRE regular expressions by default.
The following example shows the structure of PCRE-style regular expressions in use.
Example: Using PCRE regular expressions
rewrite r_rewrite_subst {
subst("a*", "?", value("MESSAGE") flags("utf8" "global"));
};
PCRE-style regular expressions have the following flags()
options:
disable-jit
Switches off the just-in-time compilation function for PCRE regular expressions.
dupnames
Allows using duplicate names for named subpatterns.
Configuration example:
filter { match("(?<DN>foo)|(?<DN>bar)" value(MSG) flags(store-matches, dupnames)); };
...
destination { file(/dev/stdout template("$DN\n")); };
global
Usable only in rewrite rules, flags("global")
matches for every occurrence of the expression, not only the first one.
ignore-case
Disables case-sensitivity.
newline
When configured, it changes the newline definition used in PCRE regular expressions to accept either of the following:
- a single carriage-return
- linefeed
- the sequence carriage-return and linefeed (
\\r
,\\n
and\\r\\n
, respectively)
This newline definition is used when the circumflex and dollar patterns (^
and $
) are matched against an input. By default, PCRE interprets the linefeed character as indicating the end of a line. It does not affect the \\r
, \\n
or \\R
characters used in patterns.
store-matches
Stores the matches of the regular expression into the $0, ... $255
variables. The $0
stores the entire match, $1
is the first group of the match (parentheses), and so on. Named matches (also called named subpatterns), for example, (?<name>...)
, are stored as well. Matches from the last filter expression can be referenced in regular expressions.
$*
macro, which can be further manipulated using List manipulation, or turned into a list in type-aware destinations.
unicode
Use Unicode support for UTF-8 matches: UTF-8 character sequences are handled as single characters.
utf8
An alias for the unicode
flag.