Search code examples
rsyslog

Rsyslog: how to negate 'contains' in if-then statement

if $programname == "service" then {
     if $msg !contains "test" then
         action(type="omfwd" 
            target="10.0.0.5"
            ...
            ) 
}

I'm trying to exclude a msg if it contains word 'test'. Not sure how to negate 'contains'.

From the document, it seems to be '!contains'. Tried it but no luck.

Any idea?

Solution

  • The syntax ! for negation applies to legacy selectors of the form

    :msg, !contains, "test"  /some/file

    You are using RainerScript, so the appropriate syntax is the keyword not:

    if not ($msg contains "test") then