I have this in transforms.conf to match a specific subset of syslog events I'm interested in.
[setparsing]
REGEX = category=(76|12|126|218)
DEST_KEY = queue
FORMAT = indexQueue
The problem is that there are "category" events numbered 121, 124 that get matched with the REGEX I'm using, whereas I"m only interested in "12" and "126".
How can the REGEX be tighened up to allow only the specific values I want?
Either of the following;
REGEX = category=(76|12|126|218)\b
REGEX = category=(76|12|126|218)\D
REGEX = category=(76|12|126|218)\s
should work. Will match your numbers if followed by a word boundary, non-digit and whitespace, respectively. For more info, see
http://www.regular-expressions.info
/K
What characters do you have after this string? Space?