syslog-ng 4.2.0 changed the interpretation of regexp

Evan Rempel <[email protected]> Wed, 6 Sep 2023 13:56:43 -0700
Newsgroups gmane.comp.syslog-ng
Message-ID <[email protected]>
Prior to syslog-ng 4.2.0 I was able to use a filter specified as


match("ABC\|DEF" value("MESSAGE"))

to match the exact string ABC|DEF in the MESSAGE

After upgrading to 4.2.0 this will match either ABC or DEF in the MESSAGE

To match an exact string of ABC|DEF I now need to escape both the 
backslash and the pipe

match("ABC\\\|DEF" value("MESSAGE"))

I can't find anything in the release notes.

Of course I can easily solve this with single quotes, but more complex 
examples would not be so straight forward.

Can someone confirm that this was intentional, or if this is a bug.


-- 
Evan

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq