Use this documentation with care! It describes the outdated version 7, which was actively developed around 2014 and is considered dead by the rsyslog team.

This documentation reflects the latest update of the v7-stable branch. It describes the 7.6.8 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v7 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is only limited rsyslog community support available for the outdated v7 version (officially we do not support it at all, but we usually are able to answer simple questions). If you need to stick with v7, it probably is best to ask your distribution for support.

Expressions

The language supports arbitrary complex expressions. All usual operators are supported. The precedence of operations is as follows (with operations being higher in the list being carried out before those lower in the list, e.g. multiplications are done before additions.

  • expressions in parenthesis
  • not, unary minus
  • *, /, % (modulus, as in C)
  • +, -, & (string concatenation)
  • ==, !=, <>, <, >, <=, >=, contains (strings!), startswith (strings!)
  • and
  • or

For example, “not a == b” probably returns not what you intended. The script processor will first evaluate “not a” and then compare the resulting boolean to the value of b. What you probably intended to do is “not (a == b)”. And if you just want to test for inequality, we highly suggest to use “!=” or “<>”. Both are exactly the same and are provided so that you can pick whichever you like best. So inquality of a and b should be tested as “a <> b”. The “not” operator should be reserved to cases where it actually is needed to form a complex boolean expression. In those cases, parenthesis are highly recommended.

Previous topic

Data Types

Next topic

Functions

This Page