David,
I have extended RainerScript with the ability to call functions. The current
implementation is very much focused on the immediate needs and it has a VM
instruction set design issue that prevents nested function calls from
working. Also, it only supports build-in functions (not loadable modules),
and the only build-in function so far is strlen() ;) - but it should do what
you need.
So far, it resides in its own git branch "rscript-func". I will continue to
work on it (at least on the VM opcode issue), but would really appreciate
some early feedback. With that version you can do things like
if strlen($msg) > 80 then @@tcp-host
if strlen($msg) <= 80 then @udp-host
Note that the function argument can be any valid expression (but NOT another
function call!), so the following is also valid (and maybe useful to get to a
better guess):
if strlen($msg & $syslogtag & $fromhost) > 80 then @@tcp-host
Note that & is the string concatenation operator.
Today's commit:
http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=e8499c6d33d09f6d8b42df72
da1661be0ef0f088
Feedback from you and all others is appreciated.
Rainer
> -----Original Message-----
> From: rsyslog-bounces@lists.adiscon.com [mailto:rsyslog-
> bounces@lists.adiscon.com] On Behalf Of Rainer Gerhards
> Sent: Monday, March 09, 2009 7:15 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] filtering by message size
>
> Hi David,
>
> Sorry for the late reply. Of course, the change is not as trivial as I
> initially thought. It is very easy to add a length modifier to the
> property replacer, but you can not use the property replacer in
> property-based filters. Of course, I can modify those filters, but
> there
> no concept of a numerical value with these filters. The proper thing
> would be to do this in the script engine, where it was scheduled for,
> but the script engine does not yet support functions. Doh...
>
> I will look where I can best hack this into. My current thinking is
> that
> I will check what it takes to make the script engine support built-in
> (rather than loadable) functions, so that I could implement a set of
> core functions. I am not sure how much effort that is, but it doesn't
> look too scary (plus it would be really good to have this
> functionality,
> so it would be well-spent time). It that turns out not to be an option,
> I'll probably hack the script engine to support a unary operation
> "lengthof", that should be simple enough - but it is a dirty approach.
> I
> won't be able to do anything of this today, but I hope I can do either
> of the two within this week.
>
> Rainer
>
> > -----Original Message-----
> > From: rsyslog-bounces@lists.adiscon.com
> > [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of david@lang.hm
> > Sent: Wednesday, March 04, 2009 8:06 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] filtering by message size
> >
> > On Wed, 4 Mar 2009, Rainer Gerhards wrote:
> >
> > > Oh, that's an interesting use case. It is not yet possible.
> > I think we
> > > can implement (fairly simple) the size for a field (via the
> property
> > > replacer). However, that does not help you with the
> > resulting size of a
> > > template string. I probably also need to check the supporting
> > > infrastructure for "greater than" comparisons...
> > >
> > > Would that help?
> >
> > yes, I can set the value to something conservative to account for the
> > variable-length fields.
> >
> > David Lang
> >
> > > Rainer
> > >
> > >> -----Original Message-----
> > >> From: rsyslog-bounces@lists.adiscon.com
> > >> [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of
> > david@lang.hm
> > >> Sent: Wednesday, March 04, 2009 12:54 AM
> > >> To: rsyslog-users
> > >> Subject: [rsyslog] filtering by message size
> > >>
> > >> is it possible to filter by message size?
> > >>
> > >> I'm looking at a situation where I would like to send the
> > >> message via UDP
> > >> if it's below a given size and by TCP if it's larger.
> > >>
> > >> David Lang
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com
> > >>
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
I have extended RainerScript with the ability to call functions. The current
implementation is very much focused on the immediate needs and it has a VM
instruction set design issue that prevents nested function calls from
working. Also, it only supports build-in functions (not loadable modules),
and the only build-in function so far is strlen() ;) - but it should do what
you need.
So far, it resides in its own git branch "rscript-func". I will continue to
work on it (at least on the VM opcode issue), but would really appreciate
some early feedback. With that version you can do things like
if strlen($msg) > 80 then @@tcp-host
if strlen($msg) <= 80 then @udp-host
Note that the function argument can be any valid expression (but NOT another
function call!), so the following is also valid (and maybe useful to get to a
better guess):
if strlen($msg & $syslogtag & $fromhost) > 80 then @@tcp-host
Note that & is the string concatenation operator.
Today's commit:
http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=e8499c6d33d09f6d8b42df72
da1661be0ef0f088
Feedback from you and all others is appreciated.
Rainer
> -----Original Message-----
> From: rsyslog-bounces@lists.adiscon.com [mailto:rsyslog-
> bounces@lists.adiscon.com] On Behalf Of Rainer Gerhards
> Sent: Monday, March 09, 2009 7:15 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] filtering by message size
>
> Hi David,
>
> Sorry for the late reply. Of course, the change is not as trivial as I
> initially thought. It is very easy to add a length modifier to the
> property replacer, but you can not use the property replacer in
> property-based filters. Of course, I can modify those filters, but
> there
> no concept of a numerical value with these filters. The proper thing
> would be to do this in the script engine, where it was scheduled for,
> but the script engine does not yet support functions. Doh...
>
> I will look where I can best hack this into. My current thinking is
> that
> I will check what it takes to make the script engine support built-in
> (rather than loadable) functions, so that I could implement a set of
> core functions. I am not sure how much effort that is, but it doesn't
> look too scary (plus it would be really good to have this
> functionality,
> so it would be well-spent time). It that turns out not to be an option,
> I'll probably hack the script engine to support a unary operation
> "lengthof", that should be simple enough - but it is a dirty approach.
> I
> won't be able to do anything of this today, but I hope I can do either
> of the two within this week.
>
> Rainer
>
> > -----Original Message-----
> > From: rsyslog-bounces@lists.adiscon.com
> > [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of david@lang.hm
> > Sent: Wednesday, March 04, 2009 8:06 AM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] filtering by message size
> >
> > On Wed, 4 Mar 2009, Rainer Gerhards wrote:
> >
> > > Oh, that's an interesting use case. It is not yet possible.
> > I think we
> > > can implement (fairly simple) the size for a field (via the
> property
> > > replacer). However, that does not help you with the
> > resulting size of a
> > > template string. I probably also need to check the supporting
> > > infrastructure for "greater than" comparisons...
> > >
> > > Would that help?
> >
> > yes, I can set the value to something conservative to account for the
> > variable-length fields.
> >
> > David Lang
> >
> > > Rainer
> > >
> > >> -----Original Message-----
> > >> From: rsyslog-bounces@lists.adiscon.com
> > >> [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of
> > david@lang.hm
> > >> Sent: Wednesday, March 04, 2009 12:54 AM
> > >> To: rsyslog-users
> > >> Subject: [rsyslog] filtering by message size
> > >>
> > >> is it possible to filter by message size?
> > >>
> > >> I'm looking at a situation where I would like to send the
> > >> message via UDP
> > >> if it's below a given size and by TCP if it's larger.
> > >>
> > >> David Lang
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com
> > >>
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com