Hello,

if I have a logline like this

Feb 27 10:26:25.942420 server process [32674:t@27   ]/warn:  [user_id:environment] - Outgoing queue size increased: 16001

It would be nice to be able to create trigger name or a notification that can extract specific keywords from that string.

For instance if the trigger was:

{log[{#LOG_PREFIX}.log,"{$LOG_REGEXP}",,,skip].iregexp(@queuesize, 600)}=1

and the regexp *@queuesize using a group to extract the values we are interested in.:

\/warn: \[([^:]+).*queue size increased: ([0-9]{5}) 

The it would be nice if we could create a trigger name like this:

{#PROCESS} on {HOSTNAME}: User: {ITEM.VALUE#1} Outgoing queue is high: {ITEM.VALUE#2}

to extract the 1st and 2ndregular expression group to get something like

process on hostname: User: user_id Outgoing queue is high: 16001 

This could be also adapted to extract a positional substring

{#PROCESS} on {HOSTNAME}: Outgoing queue is high {ITEM.VALUE##1,15}