Forum Discussion
Gill_32697
Nimbostratus
Apr 27, 2015tmsh Syslog match filter script
This is a snippet of a syslog filter that is work perfectly.
--
filter f_custom {
(level(notice)
and match(\"Pool /Common/\"))
;
--
I'm needing to add a few more search filters but cant g...
VernonWells
Employee
Apr 27, 2015Do you want it to match a message that contains both "Virtual /Common/" AND "pool /Common/", or messages that contain either of those (but not necessarily both)?
To get the "either" match:
filter f_custom {
level (notice) and (match (\"Virtual /Common/\") or match (\"pool /Common/\"));
};
To get the "and" match, you can either:
filter f_custom {
level (notice) and match (\"Virtual /Common/\") and match (\"pool /Common/\");
};
or you can string together filters:
filter f_notice_only {
level (notice);
};
filter f_virtual_common {
match (\"Virtual /Common/\");
};
filter f_pool_common {
match (\"pool /Common/\")
};
log {
source (s_syslog_pipe);
filter (f_notice_only); filter (f_virtual_common); filter (f_pool_common);
destination (d_your_custom_destination);
};
The
log stanza implies "AND" operations between the selectors.Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects