/* note: variables are strings (at least in v7), so we need to convert * to a number when we check the conditon. * Even if we change the variable representation at some later point, * we should NOT change this test here, but better add a new one. * rgerhards, 2013-11-19 */ $IncludeConfig diag-common.conf template(name="outfmt" type="string" string="%$!nbr%\n") module(load="../plugins/imtcp/.libs/imtcp") input(type="imtcp" port="13514") if $msg contains "msgnum:" then { set $!nbr = field($msg, 58, 2); if cnum($!nbr) < 100 then stop /* check is intentionally more complex than needed! */ else if not (cnum($!nbr) > 999) then { action(type="omfile" file="rsyslog.out.log" template="outfmt") } }