Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup the logentries service. If a log entry has a token in it then I would like to send it to api.logentries.com:10000. The token is a guid in the format aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee.

Right now I'm doing:

# If there's a logentries token then send it directly to logentries 
:msg, regex, ".*[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.*"
& @@api.logentries.com:10000 

I checked the rsyslog debug logs and my regex is not matching, but I can't figure out why or how to fix it:

5245.961161378:7fb79b514700: Filter: check for property 'msg' (value ' fb1c507f-2ede-4d7f-a140-2bd8d56e133 - application - [play-akka.actor.default-dispatcher-1] - Found user: 4fb11ea5e4b00a1aeebe2800') regex '.*[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.*': FALSE
share|improve this question

2 Answers 2

rsyslog being the steaming pile of garbage that it is doesn't accept curly braces in a regex a fact which is completely unmentioned in the documentation. Thus, the following regex:


Needs to be rewritten as:

share|improve this answer
$msg , regex, yourRegEx @api.logentries.com:10000 // Filter out and send
& ~ // Discard whatever matched the rule

$template myTemplate,"TOKEN %msg%" 
*.* @api.logentries.com:10000?myTemplate

I haven't test it ... but it will be something like that

share|improve this answer
Thanks for the answer. I'm having a hard time reading it due to formatting though. Is everything after the "//" a comment? Is the "& ~" commented out and not do anything? I've updated my question to include what was my best guess and would really appreciate it if you can tell me if I'm doing anything wrong. –  benmccann Dec 20 '12 at 2:12
&~ should be on the next line, it matches everything in the last match, and in this case, discards it. - This stops the syslog line being sent onwards. –  Sirex Dec 20 '12 at 2:28
Also, SF tip. Usually the formatting in the answer is ok, but the rendering is messed up. If you click "edit" on the answer (but cancel rather than making changes) you can usually see what the author intended. –  Sirex Dec 20 '12 at 2:30
Thanks. Is it supposed to be $msg? The docs have :msg. rsyslog.com/doc/rsyslog_conf_filter.html –  benmccann Dec 20 '12 at 2:40
I found out the problem is that my regex is not matching by running rsyslog in debug mode and looking at the logs it created. Do you have any ideas what I can do to fix my regex? It looks okay to me. –  benmccann Dec 20 '12 at 4:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.