# PASS only logs NOT containing the string 'connection reset by peer' to next module
*.emerg	%regex -v -m 'connection reset by peer' %classic root

# PASS only logs containing the string 'disk full' to next module
*.emerg	%regex -m 'disk full' %classic root

# PASS ONLY logs with host matching 'www'
*.emerg	%regex -h 'www' %classic /var/log/webserver

# MORPH MESSAGE BY ADDING ON
*.emerg %regex -m '.*' -s '$0: MORPH RULE' %classic /var/log/morph

# MORPH A DATE IN THE MESSAGE
*.emerg %regex -m '^(.*[^0-9]){0,1}([0-9]+)/([0-9]+)/([0-9]+)(.*)$' -s '$1$4/$2/$3$5' %classic /var/log/morph

# PASS ONLY logs with host from 8pm to 9am  (20:00:00 to 09:00:00)
# and also matching 'root'
#auth.info %regex -v -t '^1' %regex -m 'root' %classic /var/log/webserver

