Literal string searches
Literal string searches have the following
Usable only in rewrite rules,
flags("global") matches for every occurrence of the expression, not only the first one.
During the matching process, patterns (also called search expressions) are matched against the input string starting from the beginning of the input string, and the input string is matched only for the maximum character length of the pattern. The initial characters of the pattern and the input string must be identical in the exact same order, and the pattern’s length is definitive for the matching process (that is, if the pattern is longer than the input string, the match will fail).
Example: matching / non-matching patterns for the input string ’exam'
For the input string
the following patterns will match:
'ex'(the pattern contains the initial characters of the input string in the exact same order)
'exam'(the pattern is an exact match for the input string)
the following patterns will not match:
'example'(the pattern is longer than the input string)
'hexameter'(the pattern’s initial characters do not match the input string’s characters in the exact same order, and the pattern is longer than the input string)
Stores the matches of the regular expression into the
$0, ... $255 variables. The
$0 stores the entire match,
$1 is the first group of the match (parentheses), and so on. Named matches (also called named subpatterns), for example,
(?<name>...), are stored as well. Matches from the last filter expression can be referenced in regular expressions.
NoteTo convert match variables into a AxoSyslog list, use the
$\*macro, which can be further manipulated using List manipulation, or turned into a list in type-aware destinations.
The given literal string will match when the pattern is found within the input. Unlike
flags("prefix"), the pattern does not have to be identical with the given literal string.