Hi David,
Sorry for the late reply. Of course, the change is not as trivial as I
initially thought. It is very easy to add a length modifier to the
property replacer, but you can not use the property replacer in
property-based filters. Of course, I can modify those filters, but there
no concept of a numerical value with these filters. The proper thing
would be to do this in the script engine, where it was scheduled for,
but the script engine does not yet support functions. Doh...
I will look where I can best hack this into. My current thinking is that
I will check what it takes to make the script engine support built-in
(rather than loadable) functions, so that I could implement a set of
core functions. I am not sure how much effort that is, but it doesn't
look too scary (plus it would be really good to have this functionality,
so it would be well-spent time). It that turns out not to be an option,
I'll probably hack the script engine to support a unary operation
"lengthof", that should be simple enough - but it is a dirty approach. I
won't be able to do anything of this today, but I hope I can do either
of the two within this week.
Rainer
> -----Original Message-----
> From: rsyslog-bounces@lists.adiscon.com
> [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of david@lang.hm
> Sent: Wednesday, March 04, 2009 8:06 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] filtering by message size
>
> On Wed, 4 Mar 2009, Rainer Gerhards wrote:
>
> > Oh, that's an interesting use case. It is not yet possible.
> I think we
> > can implement (fairly simple) the size for a field (via the property
> > replacer). However, that does not help you with the
> resulting size of a
> > template string. I probably also need to check the supporting
> > infrastructure for "greater than" comparisons...
> >
> > Would that help?
>
> yes, I can set the value to something conservative to account for the
> variable-length fields.
>
> David Lang
>
> > Rainer
> >
> >> -----Original Message-----
> >> From: rsyslog-bounces@lists.adiscon.com
> >> [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of
> david@lang.hm
> >> Sent: Wednesday, March 04, 2009 12:54 AM
> >> To: rsyslog-users
> >> Subject: [rsyslog] filtering by message size
> >>
> >> is it possible to filter by message size?
> >>
> >> I'm looking at a situation where I would like to send the
> >> message via UDP
> >> if it's below a given size and by TCP if it's larger.
> >>
> >> David Lang
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com
> >>
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com