有一个来自程序（即supervisord）的日志inputrsyslog。 他们的消息从" real-program-name rest of the message" ，我试图：
real-program-name设置为real-program-name而不是supervisord 我目前正在这样做：
if ($programname == "supervisord") then { set $.programname = re_extract($msg, "^ ([^ ]+)", 0, 1, $programname); set $.msg = re_extract($msg, "^ [^ ]+ (.+)", 0, 1, $msg); }
（编辑：我用$!而不是$.试过，同样的问题）
在我的configuration文件/脚本中的以下行是
if ($programname startswith "real") then {...}
所以日志告诉我，程序名是否被真正的程序名取代
日志说：
processBATCH: next msg 0: <14>Nov 22 10:51:55 supervisord: real-program-name 127.0.0.1 - - [22/Nov/2017:10:51:55 +0000] "GET /blabla IF var 'programname' == string 'supervisord' eval expr 0x1a4e0b0, type 'CMP_EQ' eval expr 0x1a4dcd0, type 'V' rainerscript: (string) var 17: 'supervisord' eval expr 0x1a4dcd0, return datatype 'S':0 eval expr 0x1a4e0b0, return datatype 'N':1 if condition result is 1 SET .programname = function 're_extract' (id:8, params:5) var 'msg' string '^ ([^ ]+)' 0 1 var 'programname' END SET eval expr 0x1a4e270, type 'F' rainerscript: executing function id 8 eval expr 0x1a4dd00, type 'V' rainerscript: (string) var 1: ' real-program-name 127.0.0.1 - - [22/Nov/2017:10:51:55 +0000] "GET /blabla" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0"' eval expr 0x1a4dd00, return datatype 'S':0 eval expr 0x1a4e170, type 'N' eval expr 0x1a4e170, return datatype 'N':0 eval expr 0x1a4e190, type 'N' eval expr 0x1a4e190, return datatype 'N':1 re_extract: regexec return is 0 re_extract: regex: end search, found 1 eval expr 0x1a4e270, return datatype 'S':0 SET .msg = function 're_extract' (id:8, params:5) var 'msg' string '^ [^ ]+ (.+)' 0 1 var 'msg' END SET eval expr 0x1a53290, type 'F' rainerscript: executing function id 8 eval expr 0x1a534e0, type 'V' rainerscript: (string) var 1: ' real-program-name 127.0.0.1 - - [22/Nov/2017:10:51:55 +0000] "GET /blabla HTTP/1.0" 200 - "" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0"' eval expr 0x1a534e0, return datatype 'S':0 eval expr 0x1a53160, type 'N' eval expr 0x1a53160, return datatype 'N':0 eval expr 0x1a53180, type 'N' eval expr 0x1a53180, return datatype 'N':1 re_extract: regexec return is 0 re_extract: regex: end search, found 1 eval expr 0x1a53290, return datatype 'S':0 IF var 'programname' STARTSWITH string 'real' eval expr 0x1a545f0, type 'CMP_STARTSWITH' eval expr 0x1a546b0, type 'V' rainerscript: (string) var 17: 'supervisord' eval expr 0x1a546b0, return datatype 'S':0 eval expr 0x1a545f0, return datatype 'N':0 if condition result is 0
我把它解释为：日志来forms主pipe，正则expression式提取进行得很好，但set没有影响。
我究竟做错了什么 ？