diff --git a/_includes/doc/admin-guide/options/host-override.md b/_includes/doc/admin-guide/options/host-override.md index 479e80a0..5cf817c6 100644 --- a/_includes/doc/admin-guide/options/host-override.md +++ b/_includes/doc/admin-guide/options/host-override.md @@ -3,5 +3,5 @@ | Type: | string| | Default: || -*Description:* Replaces the ${HOST} part of the message with the +*Description:* Replaces the HOST part of the message with the parameter string. diff --git a/_includes/doc/admin-guide/options/source-flags.md b/_includes/doc/admin-guide/options/source-flags.md index 73665214..8929241c 100644 --- a/_includes/doc/admin-guide/options/source-flags.md +++ b/_includes/doc/admin-guide/options/source-flags.md @@ -55,8 +55,8 @@ - *no-hostname*: Enable the no-hostname flag if the log message does not include the hostname of the sender host. That way {{ site.product.short_name }} - assumes that the first part of the message header is ${PROGRAM} - instead of ${HOST}. For example: + assumes that the first part of the message header is PROGRAM + instead of HOST. For example: ```config source s_dell { diff --git a/doc/_admin-guide/020_The_concepts_of_syslog-ng/004_Timezones_and_daylight_saving.md b/doc/_admin-guide/020_The_concepts_of_syslog-ng/004_Timezones_and_daylight_saving.md index 1e530a12..6652afe8 100644 --- a/doc/_admin-guide/020_The_concepts_of_syslog-ng/004_Timezones_and_daylight_saving.md +++ b/doc/_admin-guide/020_The_concepts_of_syslog-ng/004_Timezones_and_daylight_saving.md @@ -88,7 +88,7 @@ includes timezone information. That way you do not need to adjust the recv-time-zone() parameter of syslog-ng. If you want {{ site.product.short_name }} to output timestamps in Unix (POSIX) time format, -use the `S_UNIXTIME` and `R_UNIXTIME` macros. You do not need to +use the ${S_UNIXTIME} and ${R_UNIXTIME} macros. You do not need to change any of the timezone related parameters, because the timestamp information of incoming messages is converted to Unix time internally, and Unix time is a timezone-independent time representation. (Actually, diff --git a/doc/_admin-guide/060_Sources/140_Python/001_Python_logmessage_API.md b/doc/_admin-guide/060_Sources/140_Python/001_Python_logmessage_API.md index d0bada6a..814a6fd0 100644 --- a/doc/_admin-guide/060_Sources/140_Python/001_Python_logmessage_API.md +++ b/doc/_admin-guide/060_Sources/140_Python/001_Python_logmessage_API.md @@ -18,7 +18,7 @@ from syslogng import LogMessage # Initialize an empty message with default values (recvd timestamp, rcptid, hostid, ...) msg = LogMessage() -# Initialize a message and set its ${MESSAGE} field to the specified argument +# Initialize a message and set its MESSAGE field to the specified argument msg = LogMessage("string or bytes-like object") ``` diff --git a/doc/_admin-guide/060_Sources/150_snmptrap/000_snmptrap_options.md b/doc/_admin-guide/060_Sources/150_snmptrap/000_snmptrap_options.md index b87a4f15..b23c4fe9 100644 --- a/doc/_admin-guide/060_Sources/150_snmptrap/000_snmptrap_options.md +++ b/doc/_admin-guide/060_Sources/150_snmptrap/000_snmptrap_options.md @@ -30,7 +30,7 @@ Default value: .snmp. option. *Description:* The snmptrap() source automatically parses the traps into name-value pairs, so you can handle the content of the trap as a structured message. Consequently, you might not even need the -`${MESSAGE}` part of the log message. If set-message-macro() is set to -**no**, {{ site.product.short_name }} leaves the `${MESSAGE}` part empty. If +MESSAGE part of the log message. If set-message-macro() is set to +**no**, {{ site.product.short_name }} leaves the MESSAGE part empty. If set-message-macro() is set to **yes**, {{ site.product.short_name }} generates a regular log message from the trap. diff --git a/doc/_admin-guide/060_Sources/220_unix-stream_unix-dgram/000_Unix_credentials.md b/doc/_admin-guide/060_Sources/220_unix-stream_unix-dgram/000_Unix_credentials.md index febff3e8..cb7a9c52 100644 --- a/doc/_admin-guide/060_Sources/220_unix-stream_unix-dgram/000_Unix_credentials.md +++ b/doc/_admin-guide/060_Sources/220_unix-stream_unix-dgram/000_Unix_credentials.md @@ -18,5 +18,5 @@ command). Similar information is available for the | ${.unix.exe} | The path of the executable belonging to the PID that sent the message. For example, /usr/bin/su | | ${.unix.gid} | The group ID (GID) corresponding to the UID of the application that sent the log message. Note that this is the ID number of the group, not its human-readable name. For example, 0 | | ${.unix.pid} | The process ID (PID) of the application that sent the log message. For example, 774. | -| | Note that on every UNIX platforms, if the system() source uses sockets, it will overwrite the PID macro with the value of ${.unix.pid}, if it is available. | +| | Note that on every UNIX platforms, if the system() source uses sockets, it will overwrite the ${PID} macro with the value of ${.unix.pid}, if it is available. | | ${.unix.uid} | The user ID (UID) of the application that sent the log message. Note that this is the ID number of the user, not its human-readable name. For example, 0 | diff --git a/doc/_admin-guide/070_Destinations/220_Riemann/000_Riemann_options.md b/doc/_admin-guide/070_Destinations/220_Riemann/000_Riemann_options.md index 554ffebb..db7a866f 100644 --- a/doc/_admin-guide/070_Destinations/220_Riemann/000_Riemann_options.md +++ b/doc/_admin-guide/070_Destinations/220_Riemann/000_Riemann_options.md @@ -128,7 +128,7 @@ destination d_riemann { *Description:* The numeric value to add as the metric field of the Riemann event. If possible, include type-hinting as well, otherwise the Riemann server will interpret the value as a floating-point number. The -following example specifies the SEQNUM macro as an integer. +following example specifies the ${SEQNUM} macro as an integer. ```config metric(int("${SEQNUM}")) diff --git a/doc/_admin-guide/070_Destinations/220_Riemann/README.md b/doc/_admin-guide/070_Destinations/220_Riemann/README.md index 09e5816e..64302466 100644 --- a/doc/_admin-guide/070_Destinations/220_Riemann/README.md +++ b/doc/_admin-guide/070_Destinations/220_Riemann/README.md @@ -22,7 +22,7 @@ riemann( ### Example: Using the riemann() driver -The following destination sends the value of the SEQNUM macro (the +The following destination sends the value of the ${SEQNUM} macro (the number of messages sent to this destination) as a metric to the Riemann server. diff --git a/doc/_admin-guide/070_Destinations/250_snmp/000_Converting_Cisco_messages.md b/doc/_admin-guide/070_Destinations/250_snmp/000_Converting_Cisco_messages.md index 8cd5f3b9..487b47c4 100644 --- a/doc/_admin-guide/070_Destinations/250_snmp/000_Converting_Cisco_messages.md +++ b/doc/_admin-guide/070_Destinations/250_snmp/000_Converting_Cisco_messages.md @@ -34,9 +34,9 @@ the Cisco website. ## Parsing Cisco-specific message fields with patterndb -The ${PROGRAM} part of the syslog messages sent by Cisco devices +The PROGRAM part of the syslog messages sent by Cisco devices contain not only the program name, but other important protocol -information part as well. The ${PROGRAM} of these messages contains the +information part as well. The PROGRAM of these messages contains the Facility, Severity, and the Mnemonic (the Cisco name) of the message. The following pattern database parses these values and makes them available as the .cisco.Facility, .cisco.Severity, and .cisco.MsgName, diff --git a/doc/_admin-guide/070_Destinations/300_syslog/README.md b/doc/_admin-guide/070_Destinations/300_syslog/README.md index d8894fff..b215f5a5 100644 --- a/doc/_admin-guide/070_Destinations/300_syslog/README.md +++ b/doc/_admin-guide/070_Destinations/300_syslog/README.md @@ -70,6 +70,6 @@ destination d_syslog_tls { ``` **NOTE:** If a message uses the IETF-syslog format (RFC-5424), only the text -of the message can be customized (that is, the ${MESSAGE} part of the +of the message can be customized (that is, the MESSAGE part of the log), the structure of the header is fixed. {: .notice--info} diff --git a/doc/_admin-guide/080_Log/000_Log_paths/003_Log_path_flags.md b/doc/_admin-guide/080_Log/000_Log_paths/003_Log_path_flags.md index 45934616..9cb0019b 100644 --- a/doc/_admin-guide/080_Log/000_Log_paths/003_Log_path_flags.md +++ b/doc/_admin-guide/080_Log/000_Log_paths/003_Log_path_flags.md @@ -89,7 +89,7 @@ log { ## Example: Using the drop-unmatched flag -In the following example, if a log message arrives whose ${MSG} part does +In the following example, if a log message arrives whose MSG part does not contain the string foo, then {{ site.product.short_name }} will discard the message and will not check compliance with the second if condition. diff --git a/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/003_inlist.md b/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/003_inlist.md index aa22557b..03f4c870 100644 --- a/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/003_inlist.md +++ b/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/003_inlist.md @@ -9,7 +9,7 @@ id: adm-log-filters-inlist in a file, allowing you to do simple, file-based black- and whitelisting. The file must be a plain-text file, containing one entry per line. The {{ site.product.short_name }} application loads the entire file, and -compares the value of the specified field (for example, ${PROGRAM}) to +compares the value of the specified field (for example, PROGRAM) to entries in the file. When you use the in-list() filter, note the following points: @@ -25,7 +25,7 @@ Available in {{ site.product.short_name }} 3.5 and later. ## Example: Selecting messages using the in-list() filter -Create a text file that contains the programs (as in the ${PROGRAM} +Create a text file that contains the programs (as in the PROGRAM field of their log messages) you want to select. For example, you want to forward only the logs of a few applications from a host: kernel, sshd, and sudo. Create the /etc/syslog-ng/programlist.list file with the diff --git a/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/005_match.md b/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/005_match.md index 46756909..b5752190 100644 --- a/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/005_match.md +++ b/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/005_match.md @@ -6,7 +6,7 @@ id: adm-log-filters-match *Synopsis:* match(regexp) \| match(regexp value(\"MACRO\")) \| match(regexp template(\"MACROS\")) *Description:* Match a regular expression to the headers and the message -itself (that is, the values returned by the MSGHDR and MSG macros). Note +itself (that is, the values returned by the ${MSGHDR} and ${MSG} macros). Note that in {{ site.product.short_name }} version 2.1 and earlier, the match() filter was applied only to the text of the message, excluding the headers. This functionality has been moved to the message() filter. diff --git a/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/006_message.md b/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/006_message.md index 1e0cdc31..fc8aadda 100644 --- a/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/006_message.md +++ b/doc/_admin-guide/080_Log/030_Filters/005_Filter_functions/006_message.md @@ -6,6 +6,6 @@ id: adm-log-filters-message *Synopsis:* message(regexp) *Description:* Match a regular expression to the text of the log -message, excluding the headers (that is, the value returned by the MSG +message, excluding the headers (that is, the value returned by the ${MSG} macros). Note that in {{ site.product.short_name }} version 2.1 and earlier, this functionality was performed by the match() filter. diff --git a/doc/_admin-guide/090_Global_options/000_Global_options.md b/doc/_admin-guide/090_Global_options/000_Global_options.md index f8e6c692..8b03e337 100644 --- a/doc/_admin-guide/090_Global_options/000_Global_options.md +++ b/doc/_admin-guide/090_Global_options/000_Global_options.md @@ -431,7 +431,7 @@ The following sub-options are available within the stats() option: Available in {{ site.product.short_name }} 4.1 and later versions. -*Description:* Configures the behavior of counting messages based on different syslog fields, like SEVERITY, FACILITY, ${HOST}. +*Description:* Configures the behavior of counting messages based on different syslog fields, like SEVERITY, FACILITY, HOST. Possible values: @@ -510,12 +510,12 @@ restarts with 1). is generated from the HOSTID and the RCPTID in the format of HOSTID@RCPTID. It has a fixed length: 16+@+8 characters. You can include the unique ID in the message by using the macro. For details, -see UNIQID. +see ${UNIQID}. Enabling this option automatically generates the HOSTID. The HOSTID is a persistent, 32-bits-long cryptographically secure pseudo random number, that belongs to the host that the {{ site.product.short_name }} is running on. If the persist file is damaged, the HOSTID might change. -Enabling this option automatically enables the RCPTID functionality. For -details, see RCPTID +Enabling this option automatically enables the ${RCPTID} functionality. For +details, see ${RCPTID}. diff --git a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/000_Formatting_messages.md b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/000_Formatting_messages.md index 190400ed..9d5c1cc8 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/000_Formatting_messages.md +++ b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/000_Formatting_messages.md @@ -20,7 +20,7 @@ syslog message, for example, to add elements of the message header to the message text. **NOTE:** If a message uses the IETF-syslog format (RFC-5424), only the text -of the message can be customized (that is, the ${MESSAGE} part of the +of the message can be customized (that is, the MESSAGE part of the log), the structure of the header is fixed. {: .notice--info} diff --git a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/002_Date_related_macros.md b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/002_Date_related_macros.md index 7500cff2..5da7c5dc 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/002_Date_related_macros.md +++ b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/002_Date_related_macros.md @@ -33,52 +33,52 @@ Alternatively, you can modify the timezone of the message using timezone-specific rewrite rules. For details, see Rewrite the timezone of a message. Converting the timezone changes the values of the following date-related -macros (macros MSEC and USEC are not changed): +macros (macros ${MSEC} and ${USEC} are not changed): -- AMPM +- ${AMPM} -- DATE +- ${DATE} -- DAY +- ${DAY} -- FULLDATE +- ${FULLDATE} -- HOUR +- ${HOUR} -- HOUR12 +- ${HOUR12} -- ISODATE +- ${ISODATE} -- ISOWEEK +- ${ISOWEEK} -- MIN +- ${MIN} -- MONTH +- ${MONTH} -- MONTH_ABBREV +- ${MONTH_ABBREV} -- MONTH_NAME +- ${MONTH_NAME} -- MONTH_WEEK +- ${MONTH_WEEK} -- SEC +- ${SEC} -- STAMP +- ${STAMP} -- TZ +- ${TZ} -- TZOFFSET +- ${TZOFFSET} -- UNIXTIME +- ${UNIXTIME} -- WEEK +- ${WEEK} -- WEEK_DAY +- ${WEEK_DAY} -- WEEK_DAY_ABBREV +- ${WEEK_DAY_ABBREV} -- WEEK_DAY_NAME +- ${WEEK_DAY_NAME} -- YEAR +- ${YEAR} -- YEAR_DAY +- ${YEAR_DAY} diff --git a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/003_Hard_vs_soft_macros.md b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/003_Hard_vs_soft_macros.md index 9d5ca9e2..8afbe35a 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/003_Hard_vs_soft_macros.md +++ b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/003_Hard_vs_soft_macros.md @@ -19,15 +19,15 @@ However, it is not possible to change the values of hard macros in rewrite rules or via any other means. The following macros in {{ site.product.short_name }} are hard macros and cannot be -modified: BSDTAG, CONTEXT\_ID, DATE, DAY, FACILITY\_NUM, FACILITY, -FULLDATE, HOUR, ISODATE, ISOWEEK, LEVEL\_NUM, LEVEL, MIN, MONTH\_ABBREV, -MONTH\_NAME, MONTH, MONTH\_WEEK, PRIORITY, PRI, RCPTID, SDATA, SEC, -SEQNUM, SOURCEIP, STAMP, TAG, TAGS, TZOFFSET, TZ, UNIXTIME, -WEEK\_DAY\_ABBREV, WEEK\_DAY\_NAME, WEEK\_DAY, WEEK, YEAR\_DAY, YEAR. +modified: ${BSDTAG}, ${CONTEXT_ID}, ${DATE}, ${DAY}, ${FACILITY_NUM}, ${FACILITY}, +${FULLDATE}, ${HOUR}, ${ISODATE}, ${ISOWEEK}, ${LEVEL_NUM}, ${LEVEL}, ${MIN}, ${MONTH_ABBREV}, +${MONTH_NAME}, ${MONTH}, ${MONTH_WEEK}, ${PRIORITY}, ${PRI}, ${RCPTID}, ${SDATA}, ${SEC}, +${SEQNUM}, ${SOURCEIP}, ${STAMP}, ${TAG}, ${TAGS}, ${TZOFFSET}, ${TZ}, ${UNIXTIME}, +${WEEK_DAY_ABBREV}, ${WEEK_DAY_NAME}, ${WEEK_DAY}, ${WEEK}, ${YEAR_DAY}, ${YEAR}. -The following macros can be modified:FULLHOST\_FROM, FULLHOST, -HOST\_FROM, HOST, LEGACY\_MSGHDR, MESSAGE, MSG,MSGID, MSGONLY, PID, -PROGRAM, SOURCE. Custom values created using rewrite rules or parsers +The following macros can be modified: ${FULLHOST_FROM}, ${FULLHOST}, +${HOST_FROM}, ${HOST}, ${LEGACY_MSGHDR}, ${MESSAGE}, ${MSG}, ${MSGID}, ${MSGONLY}, ${PID}, +${PROGRAM}, ${SOURCE}. Custom values created using rewrite rules or parsers can be modified as well, just like stored matches of regular expressions ($0 \... $255). diff --git a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/004_Macros_of_syslog-ng.md b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/004_Macros_of_syslog-ng.md index d6c43477..bfe53a2d 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/004_Macros_of_syslog-ng.md +++ b/doc/_admin-guide/110_Template_and_rewrite/000_Customize_message_format/004_Macros_of_syslog-ng.md @@ -13,7 +13,7 @@ description: >- > > If you are using the flags(no-parse) option, then syslog message parsing is > completely disabled, and the entire incoming message is treated as -> the ${MESSAGE} part of a syslog message. +> the MESSAGE part of a syslog message. > In this case, {{ site.product.short_name }} generates a new syslog header > (timestamp, host, and so on) automatically. Note that even > though flags(no-parse) disables message parsing, some flags can @@ -64,7 +64,7 @@ When used, the output specifies the local IP address of the source from which the message originates. For an example use case when using the macro is recommended, see -[[Example use case: using the ${DESTIP}, the ${DESTPORT}, and the ${PROTO} macros]] +Example use case: using the ${DESTIP}, the ${DESTPORT}, and the ${PROTO} macros ## ${DESTPORT} @@ -72,7 +72,7 @@ When used, the output specifies the local port of the source from which the message originates. For an example use case when using the macro is recommended, see -[[Example use case: using the ${DESTIP}, the ${DESTPORT}, and the ${PROTO} macros]]. +Example use case: using the ${DESTIP}, the ${DESTPORT}, and the ${PROTO} macros. ## ${FACILITY} @@ -152,8 +152,8 @@ Available in 3.24 and later. The priority (also called severity) of the message, represented as a numeric value, for example, 3. For the textual -representation of this value, use the ${LEVEL} macro. See PRIORITY or -LEVEL for details. +representation of this value, use the ${LEVEL} macro. See ${PRIORITY} or +${LEVEL} for details. ## ${LOGHOST} @@ -170,11 +170,11 @@ The hostname of the computer running {{ site.product.short_name }}. Text contents of the log message without the program name and pid. The program name and the pid together are available in the -MSGHDR and ${PID} macros. +${MSGHDR} and ${PID} macros. If you are using the flags(no-parse) option, then syslog message parsing is completely disabled, and the entire incoming message is treated as -the ${MESSAGE} part of a syslog message. In this case, {{ site.product.short_name }} +the MESSAGE part of a syslog message. In this case, {{ site.product.short_name }} generates a new syslog header (timestamp, host, and so on) automatically. Note that even though flags(no-parse) disables message parsing, some flags can still be used, for example, the no-multi-line @@ -372,7 +372,7 @@ one of the following: IETF-syslog protocol (**${.SDATA.meta.sequenceId}**), and can be added to BSD-syslog messages using the **${SEQNUM}** macro. -**NOTE:** If you need a sequence number for every log message that {{ site.product.short_name }} receives, use the RCPTID macro. +**NOTE:** If you need a sequence number for every log message that {{ site.product.short_name }} receives, use the ${RCPTID} macro. {: .notice--info} ## ${SOURCE} @@ -494,8 +494,8 @@ The day of the week as a numerical value (1-7). ## ${WEEKDAY}, ${C_WEEKDAY}, ${R_WEEKDAY}, ${S_WEEKDAY} -These macros are deprecated, use WEEK_DAY_ABBREV, R_WEEK_DAY_ABBREV, -S_WEEK_DAY_ABBREV instead. The 3-letter name of the day of week the +These macros are deprecated, use ${WEEK_DAY_ABBREV}, ${R_WEEK_DAY_ABBREV}, +${S_WEEK_DAY_ABBREV} instead. The 3-letter name of the day of week the message was sent, for example, Thu. ## ${WEEK_DAY_NAME}, ${C_WEEK_DAY_NAME}, ${R_WEEK_DAY_NAME}, ${S_WEEK_DAY_NAME} diff --git a/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/000_Replace.md b/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/000_Replace.md index bf1eea4a..15189150 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/000_Replace.md +++ b/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/000_Replace.md @@ -12,8 +12,8 @@ To replace a part of the log message, you have to: - select the field of the message that the rewrite rule should process -Substitution rules can operate on any soft macros, for example, MESSAGE, -PROGRAM, or any user-defined macros created using parsers. You can also +Substitution rules can operate on any soft macros, for example, ${MESSAGE}, +${PROGRAM}, or any user-defined macros created using parsers. You can also rewrite the structured-data fields of messages complying to the RFC-5424 (IETF-syslog) message format. diff --git a/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/003_Setting_facility.md b/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/003_Setting_facility.md index b8c70202..30c8dd28 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/003_Setting_facility.md +++ b/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/003_Setting_facility.md @@ -5,7 +5,7 @@ id: adm-temp-facility description: >- It is possible to set the facility field with the set-facility() rewrite function. When set, the set-facility() rewrite function will only - rewrite the ${PRIORITY} field in the message to the first parameter value + rewrite the PRIORITY field in the message to the first parameter value specified in the function. --- diff --git a/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/008_Custom_SDATA_fields.md b/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/008_Custom_SDATA_fields.md index e5736e2f..6438b057 100644 --- a/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/008_Custom_SDATA_fields.md +++ b/doc/_admin-guide/110_Template_and_rewrite/001_Modifying_messages/008_Custom_SDATA_fields.md @@ -46,7 +46,7 @@ rewrite r_rewrite_set { ``` If you use the **${.SDATA.custom@18372.4.sourceip}** macro in a -template or SQL table, its value will be that of the SOURCEIP macro (as +template or SQL table, its value will be that of the ${SOURCEIP} macro (as seen on the machine where the SDATA field was created) for every message that was processed with this rewrite rule, and empty for every other message. diff --git a/doc/_admin-guide/120_Parser/000_Parsing_syslog_messages/000_Syslog_parser_options.md b/doc/_admin-guide/120_Parser/000_Parsing_syslog_messages/000_Syslog_parser_options.md index 6005fade..ec30f13f 100644 --- a/doc/_admin-guide/120_Parser/000_Parsing_syslog_messages/000_Syslog_parser_options.md +++ b/doc/_admin-guide/120_Parser/000_Parsing_syslog_messages/000_Syslog_parser_options.md @@ -24,10 +24,10 @@ If you set drop-invalid() to **no**, the parsing error triggers syslog-parser() to rewrite and extend the original log message with the following additional information: -- It prepends the following message to the contents of the ${MESSAGE} +- It prepends the following message to the contents of the MESSAGE field: Error processing log message. -- It sets the contents of the ${PROGRAM} field to syslog-ng. +- It sets the contents of the PROGRAM field to syslog-ng. - It sets the contents of the facility field to syslog. diff --git a/doc/_admin-guide/120_Parser/002_Parsing_key-value_pairs/README.md b/doc/_admin-guide/120_Parser/002_Parsing_key-value_pairs/README.md index 6bdeabce..cc2e4e67 100644 --- a/doc/_admin-guide/120_Parser/002_Parsing_key-value_pairs/README.md +++ b/doc/_admin-guide/120_Parser/002_Parsing_key-value_pairs/README.md @@ -36,7 +36,7 @@ are not permitted. To parse key=value pairs, define a parser that has the kv-parser() option. Defining the prefix is optional. By default, the parser will -process the ${MESSAGE} part of the log message. You can also define the +process the MESSAGE part of the log message. You can also define the parser inline in the log path. **Declaration** diff --git a/doc/_admin-guide/120_Parser/003_JSON_parser/README.md b/doc/_admin-guide/120_Parser/003_JSON_parser/README.md index 132fc0ec..1e2819e7 100644 --- a/doc/_admin-guide/120_Parser/003_JSON_parser/README.md +++ b/doc/_admin-guide/120_Parser/003_JSON_parser/README.md @@ -40,7 +40,7 @@ messages, therefore acting as a JSON-filter as well. To create a JSON parser, define a parser that has the json-parser() option. Defining the prefix and the marker are optional. By default, the -parser will process the ${MESSAGE} part of the log message. To process +parser will process the MESSAGE part of the log message. To process other parts of a log message with the JSON parser, use the template() option. You can also define the parser inline in the log path. diff --git a/doc/_admin-guide/120_Parser/004_XML_parser/README.md b/doc/_admin-guide/120_Parser/004_XML_parser/README.md index 6512a335..d5673fc5 100644 --- a/doc/_admin-guide/120_Parser/004_XML_parser/README.md +++ b/doc/_admin-guide/120_Parser/004_XML_parser/README.md @@ -11,8 +11,8 @@ description: >- to the message object. --- -To create an XML parser, define an xml\_parser that has the xml() -option. By default, the parser will process the ${MESSAGE} part of the +To create an XML parser, define an xml_parser that has the xml() +option. By default, the parser will process the MESSAGE part of the log message. To process other parts of a log message using the XML parser, use the template() option. You can also define the parser inline in the log path. diff --git a/doc/_admin-guide/120_Parser/005_Parsing_dates/README.md b/doc/_admin-guide/120_Parser/005_Parsing_dates/README.md index 5460c989..4605b7cf 100644 --- a/doc/_admin-guide/120_Parser/005_Parsing_dates/README.md +++ b/doc/_admin-guide/120_Parser/005_Parsing_dates/README.md @@ -11,7 +11,7 @@ description: >- --- **NOTE:** Note that parsing will fail if the format string does not match -the entire template or field. Since by default {{ site.product.short_name }}({{ site.product.short_name }}) uses the ${MESSAGE} part of the log message, +the entire template or field. Since by default {{ site.product.short_name }}({{ site.product.short_name }}) uses the MESSAGE part of the log message, parsing will fail, unless the log message contains only a date, but that is unlikely, so practically you will have to segment the message (for example, using a [[csv-parser()|adm-parser-csv]]. diff --git a/doc/_admin-guide/120_Parser/009_Linux_audit_parser/README.md b/doc/_admin-guide/120_Parser/009_Linux_audit_parser/README.md index 68e06fba..6760576c 100644 --- a/doc/_admin-guide/120_Parser/009_Linux_audit_parser/README.md +++ b/doc/_admin-guide/120_Parser/009_Linux_audit_parser/README.md @@ -45,7 +45,7 @@ pairs. It automatically decodes the following fields: To parse the log messages of the Linux Audit subsystem, define a parser that has the linux-audit-parser() option. By default, the parser will -process the ${MESSAGE} part of the log message. To process other parts +process the MESSAGE part of the log message. To process other parts of a log message, use the **template()** option. You can also define the parser inline in the log path. diff --git a/doc/_admin-guide/120_Parser/013_netskope_parser.md b/doc/_admin-guide/120_Parser/013_netskope_parser.md index 43bc1523..753de31d 100644 --- a/doc/_admin-guide/120_Parser/013_netskope_parser.md +++ b/doc/_admin-guide/120_Parser/013_netskope_parser.md @@ -18,11 +18,11 @@ For example: {% include doc/admin-guide/parser-support.md %} -The {{ site.product.short_name }} application sets the ${PROGRAM} field to Netskope. +The {{ site.product.short_name }} application sets the PROGRAM field to Netskope. By default, the Netskope-specific fields are extracted into name-value -pairs prefixed with .netskope. For example, the organization\_unit in -the previous message becomes ${.netskope.organization\_unit}. You can +pairs prefixed with .netskope. For example, the organization_unit in +the previous message becomes ${.netskope.organization_unit}. You can change the prefix using the **prefix** option of the parser. **Declaration** diff --git a/doc/_admin-guide/120_Parser/018_websense_parser.md b/doc/_admin-guide/120_Parser/018_websense_parser.md index 47fbf8de..22cbb9ce 100644 --- a/doc/_admin-guide/120_Parser/018_websense_parser.md +++ b/doc/_admin-guide/120_Parser/018_websense_parser.md @@ -19,11 +19,11 @@ For example: {% include doc/admin-guide/parser-support.md %} -The {{ site.product.short_name }} application sets the ${PROGRAM} field to Websense. +The {{ site.product.short_name }} application sets the PROGRAM field to Websense. By default, the websense-specific fields are extracted into name-value -pairs prefixed with .websense. For example, the product\_version in the -previous message becomes ${.websense.product\_version}. You can change +pairs prefixed with .websense. For example, the product_version in the +previous message becomes ${.websense.product_version}. You can change the prefix using the **prefix** option of the parser. **Declaration** diff --git a/doc/_admin-guide/120_Parser/023_db_parser/000_Classifying_log_messages/000_Structure_of_a_patterndb.md b/doc/_admin-guide/120_Parser/023_db_parser/000_Classifying_log_messages/000_Structure_of_a_patterndb.md index 47f2eedc..7fbbe80e 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/000_Classifying_log_messages/000_Structure_of_a_patterndb.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/000_Classifying_log_messages/000_Structure_of_a_patterndb.md @@ -45,7 +45,7 @@ The pattern database is organized as follows: - Patterns can consist of literals (keywords, or rather, keycharacters) and pattern parsers. - **NOTE:** If the ${PROGRAM} part of a message is empty, rules with an + **NOTE:** If the PROGRAM part of a message is empty, rules with an empty Program Pattern are used to classify the message. {: .notice--info} diff --git a/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/001_External_actions.md b/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/001_External_actions.md index 007cf679..23d7afac 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/001_External_actions.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/001_External_actions.md @@ -17,7 +17,7 @@ sends them to an external script. ```xml - A log message from ${HOST} matched rule number $.classifier.rule_id + A log message from HOST matched rule number $.classifier.rule_id yes ``` diff --git a/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/README.md b/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/README.md index 78cc9685..4da806fb 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/README.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/002_Triggering_actions/README.md @@ -57,7 +57,7 @@ generates a message when a message matching the rule is received. - A log message from ${HOST} matched rule number $.classifier.rule_id + A log message from HOST matched rule number $.classifier.rule_id @@ -73,7 +73,7 @@ they will override the values of the original message. ## Example: Generating messages with inherited values The following action generates a message that is identical to the -original message, but its ${PROGRAM} field is set to +original message, but its PROGRAM field is set to overriding-original-program-name ```xml diff --git a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/000_patterns/README.md b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/000_patterns/README.md index e0e6658c..b122b8a4 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/000_patterns/README.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/000_patterns/README.md @@ -20,16 +20,16 @@ N/A ## Children - *pattern*: The name of the application --- {{ site.product.short_name }} matches this - value to the ${PROGRAM} header of the syslog message to find the + value to the PROGRAM header of the syslog message to find the rulesets applicable to the syslog message. Specifying multiple patterns is useful if two or more applications - have different names (that is, different ${PROGRAM} fields), but + have different names (that is, different PROGRAM fields), but otherwise send identical log messages. It is not necessary to use multiple patterns if only the end of the - ${PROGRAM} fields is different, use only the beginning of the - ${PROGRAM} field as the pattern. For example, the Postfix email + PROGRAM fields is different, use only the beginning of the + PROGRAM field as the pattern. For example, the Postfix email server sends messages using different process names, but all of them begin with the postfix string. @@ -39,8 +39,8 @@ N/A NOTE: If the \ element of a ruleset is not specified, {{ site.product.short_name }} will use this ruleset as a fallback ruleset: it will - apply the ruleset to messages that have an empty ${PROGRAM} header, or - if none of the program patterns matched the ${PROGRAM} header of the + apply the ruleset to messages that have an empty PROGRAM header, or + if none of the program patterns matched the PROGRAM header of the incoming message. ### Example diff --git a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/001_rules/000_rule/README.md b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/001_rules/000_rule/README.md index 02f1f09f..71bb3fd8 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/001_rules/000_rule/README.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/001_rules/000_rule/README.md @@ -69,16 +69,16 @@ The *\* element may contain any number of *\* elements. - *process*: Only messages that are generated by the same process of a client belong to the same context, that is, messages that - have identical ${HOST}, ${PROGRAM} and ${PID} values. This is + have identical HOST, PROGRAM and PID values. This is the default behavior of {{ site.product.short_name }} if context-scope is not specified. - *program*: Messages that are generated by the same application of a client belong to the same context, that is, messages that - have identical ${HOST} and ${PROGRAM} values. + have identical HOST and PROGRAM values. - *host*: Every message generated by a client belongs to the same - context, only the ${HOST} value of the messages must be + context, only the HOST value of the messages must be identical. - *global*: Every message belongs to the same context. diff --git a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/000_create_context/README.md b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/000_create_context/README.md index 8fbc7a9e..f38495df 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/000_create_context/README.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/000_create_context/README.md @@ -50,16 +50,16 @@ Available in {{ site.product.short_name }} version 3.8 and later. - *process*: Only messages that are generated by the same process of a client belong to the same context, that is, messages that - have identical ${HOST}, ${PROGRAM} and ${PID} values. This is + have identical HOST, PROGRAM and PID values. This is the default behavior of {{ site.product.short_name }} if context-scope is not specified. - *program*: Messages that are generated by the same application of a client belong to the same context, that is, messages that - have identical ${HOST} and ${PROGRAM} values. + have identical HOST and PROGRAM values. - *host*: Every message generated by a client belongs to the same - context, only the ${HOST} value of the messages must be + context, only the HOST value of the messages must be identical. - *global*: Every message belongs to the same context. diff --git a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/README.md b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/README.md index cb8f6763..39c8226e 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/README.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/000_action/README.md @@ -134,7 +134,7 @@ generates a message when a message matching the rule is received. - A log message from ${HOST} matched rule number $.classifier.rule_id + A log message from HOST matched rule number $.classifier.rule_id @@ -150,7 +150,7 @@ they will override the values of the original message. ### Example: Generating messages with inherited values The following action generates a message that is identical to the -original message, but its ${PROGRAM} field is set to +original message, but its PROGRAM field is set to overriding-original-program-name ```xml diff --git a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/README.md b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/README.md index 7db6409a..287081ba 100644 --- a/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/README.md +++ b/doc/_admin-guide/120_Parser/023_db_parser/004_The_syslog-ng_patterndb_format/000_patterndb/000_ruleset/002_actions/README.md @@ -32,7 +32,7 @@ generates a message when a message matching the rule is received. - A log message from ${HOST} matched rule number $.classifier.rule_id + A log message from HOST matched rule number $.classifier.rule_id @@ -48,7 +48,7 @@ they will override the values of the original message. ### Example: Generating messages with inherited values The following action generates a message that is identical to the -original message, but its ${PROGRAM} field is set to +original message, but its PROGRAM field is set to overriding-original-program-name ```xml diff --git a/doc/_admin-guide/130_Correlating_log_messages/002_grouping-by_options.md b/doc/_admin-guide/130_Correlating_log_messages/002_grouping-by_options.md index 97bdb7ba..14798db7 100644 --- a/doc/_admin-guide/130_Correlating_log_messages/002_grouping-by_options.md +++ b/doc/_admin-guide/130_Correlating_log_messages/002_grouping-by_options.md @@ -112,14 +112,14 @@ following values are available: - *process*: Only messages that are generated by the same process of a client belong to the same context, that is, messages that have - identical ${HOST}, ${PROGRAM} and ${PID} values. + identical HOST, PROGRAM and PID values. - *program*: Messages that are generated by the same application of a client belong to the same context, that is, messages that have - identical ${HOST} and ${PROGRAM} values. + identical HOST and PROGRAM values. - *host*: Every message generated by a client belongs to the same - context, only the ${HOST} value of the messages must be identical. + context, only the HOST value of the messages must be identical. - *global*: Every message belongs to the same context. This is the default value. diff --git a/doc/_admin-guide/140_Enriching_log_messages_with_external_data/001_Looking_up_geoip2_data/001_Using_the_geoip2_parser.md b/doc/_admin-guide/140_Enriching_log_messages_with_external_data/001_Looking_up_geoip2_data/001_Using_the_geoip2_parser.md index 8d083b5d..f6290133 100644 --- a/doc/_admin-guide/140_Enriching_log_messages_with_external_data/001_Looking_up_geoip2_data/001_Using_the_geoip2_parser.md +++ b/doc/_admin-guide/140_Enriching_log_messages_with_external_data/001_Looking_up_geoip2_data/001_Using_the_geoip2_parser.md @@ -16,8 +16,8 @@ parser parser_name { ``` In the following example, {{ site.product.short_name }} retrieves the GeoIP2 data of the -IP address contained in the ${HOST} field of the incoming message -(assuming that in this case the ${HOST} field contains an IP address), +IP address contained in the HOST field of the incoming message +(assuming that in this case the HOST field contains an IP address), and includes the data (prefixed with the geoip2 string) in the output JSON message. diff --git a/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/000_Round_robin.md b/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/000_Round_robin.md index cada0d87..658cc9d1 100644 --- a/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/000_Round_robin.md +++ b/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/000_Round_robin.md @@ -1,19 +1,19 @@ --- -title: Load balancing with a round robin load balancing method based on the R_MSEC macro of {{ site.product.short_name }} +title: Load balancing with a round robin load balancing method based on the ${R_MSEC} macro of {{ site.product.short_name }} short_title: Load balancing with round robin id: adm-pract-round-robin description: >- This section describes a round robin load balancing method based on the - R_MSEC macro of {{ site.product.short_name }} to load + ${R_MSEC} macro of {{ site.product.short_name }} to load balance your logs between multiple {{ site.product.short_name }} destinations. --- -**TIP:** If R_MSEC is not precise enough, you can replace it with R_USEC +**TIP:** If ${R_MSEC} is not precise enough, you can replace it with ${R_USEC} (which uses microseconds instead of milliseconds). {: .notice--info} -For more information about the R_MSEC macro and further macros of -{{ site.product.short_name }}, see Macros of {{ site.product.short_name }}. +For more information about the ${R_MSEC} macro and further macros, +see Macros of {{ site.product.short_name }}. ## Example: round robin load balancing between multiple destinations @@ -51,7 +51,7 @@ destination d_lb_network { The filter {\" \\" == \"$(% ${R_MSEC} 2)\"}; code snippets (in bold) serve as the basis of the method. This filter -separates incoming log messages\' timestamp values based on the R_MSEC +separates incoming log messages\' timestamp values based on the ${R_MSEC} macro, using a division with remainder method, and distributes the log messages equally between two destinations based on the return value (in this case, 0 or 1). @@ -61,5 +61,5 @@ destination with the file in the example (and use the same analogy for any other {{ site.product.short_name }} destinations). For an alternative method to use the round robin load balancing method -based on the R_MSEC macro, see -Configuration generator for the load balancing method based on MSEC hashing. +based on the ${R_MSEC} macro, see +Configuration generator for the load balancing method based on ${R_MSEC} hashing. diff --git a/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/001_msec_hashing.md b/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/001_msec_hashing.md index eaf437f7..8beea92a 100644 --- a/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/001_msec_hashing.md +++ b/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/001_msec_hashing.md @@ -1,10 +1,10 @@ --- -title: Configuration generator for the load balancing method based on MSEC hashing +title: Configuration generator for the load balancing method based on ${R_MSEC} hashing short_title: Configuration generator id: adm-pract-msec description: >- This section describes a configuration generator for the load balancing - method based on MSEC hashing to load balance your logs between multiple + method based on ${R_MSEC} hashing to load balance your logs between multiple {{ site.product.short_name }} destinations. --- @@ -29,4 +29,4 @@ destination d_lb { ``` Where destinations share the same configuration except for the -destination address, balancing is based on MSEC hashing. +destination address, balancing is based on ${R_MSEC} hashing. diff --git a/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/README.md b/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/README.md index b39bdb49..5e7db588 100644 --- a/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/README.md +++ b/doc/_admin-guide/180_Best_practices_and_examples/005_Load_balancing_logs/README.md @@ -5,10 +5,10 @@ description: >- These sections describe a method of load balancing logs between multiple {{ site.product.short_name }} destinations. The first subsection describes the round robin load balancing method based on the - R_MSEC macro of {{ site.product.short_name }}, while the second subsection describes a + ${R_MSEC} macro of {{ site.product.short_name }}, while the second subsection describes a configuration generator that you can use as an alternative to using the example configuration described in the first subsection. --- -For more information about the R_MSEC macro and further macros of +For more information about the ${R_MSEC} macro and further macros of {{ site.product.short_name }}, see Macros of {{ site.product.short_name }}. diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_pdbtool.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_pdbtool.md index c4cf9eff..e4ca1979 100644 --- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_pdbtool.md +++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_pdbtool.md @@ -171,7 +171,7 @@ The match command has the following options: - \--message or -M - The text of the log message to match (only the ${MESSAGE} part + The text of the log message to match (only the MESSAGE part without the syslog headers). - \--pdb or -p @@ -180,7 +180,7 @@ The match command has the following options: - \--program or -P - Name of the program to use, as contained in the ${PROGRAM} part of + Name of the program to use, as contained in the PROGRAM part of the syslog message. - \--template=\ or -T diff --git a/doc/_dev-guide/chapter_8/section_3.md b/doc/_dev-guide/chapter_8/section_3.md index 644da01f..b7495ca4 100644 --- a/doc/_dev-guide/chapter_8/section_3.md +++ b/doc/_dev-guide/chapter_8/section_3.md @@ -476,7 +476,7 @@ parse_ordered_list_into_log_message_no_check(const gchar *ordered_list) /* First get a copy of our parser */ cloned_parser = (LogParser *) log_pipe_clone(&ordered_parser->super); - /* Set the ${MESSAGE} part of our dummy log message */ + /* Set the MESSAGE part of our dummy log message */ msg = log_msg_new_empty(); log_msg_set_value(msg, LM_V_MESSAGE, ordered_list, -1); diff --git a/doc/_dev-guide/chapter_8/section_4.md b/doc/_dev-guide/chapter_8/section_4.md index 7b6d4209..06479ffc 100644 --- a/doc/_dev-guide/chapter_8/section_4.md +++ b/doc/_dev-guide/chapter_8/section_4.md @@ -226,7 +226,7 @@ First we need to get the message we want from the array. `num_msg` starts counti LogMessage *msg = msgs[num_msg - 1]; ``` -Now that we have our `LogMessage`, we will extract the `${MESSAGE}` part from it to evaluate its length. To do so, we call the `log_msg_get_value` function with the appropriate constant. +Now that we have our `LogMessage`, we will extract the MESSAGE part from it to evaluate its length. To do so, we call the `log_msg_get_value` function with the appropriate constant. ``` const gchar *message_part = log_msg_get_value(msg, LM_V_MESSAGE, NULL); ```