syslog-ng Open Source Edition 3.16 - Release Notes

if-else-elif: Conditional expressions

You can use if {}, elif {}, and else {} blocks to configure conditional expressions.

Conditional expressions have two formats:

• Explicit filter expression:

  if (message('foo')) {
      parser { date-parser(); };
  } else {
      ...
  };

  This format only uses the filter expression in if(). If if does not contain 'foo', the else branch is taken.

  The else{} branch can be empty, you can use it to send the message to the default branch.

• Condition embedded in the log path:

  if {
      filter { message('foo')); };
      parser { date-parser(); };
  } else {
      ...
  };

  This format considers all filters and all parsers as the condition, combined. If the message contains 'foo' and the date-parser() fails, the else branch is taken. Similarly, if the message does not contain 'foo', the else branch is taken.

An alternative, less straightforward way to implement conditional evaluation is to use junctions. For details on junctions and channels, see Junctions and channels.