--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/pvl/syslog/rule.py	Thu Jan 03 13:04:51 2013 +0200
@@ -0,0 +1,54 @@
+from pvl.syslog.filter import SyslogFilter
+
+import re
+
+import logging; log = logging.getLogger('pvl.syslog.rule')
+
+class SyslogRule (object) :
+    """
+        A rule matches syslog lines, and formats them.
+            
+            tag         - apply given tag to matches
+    """
+        
+    def __init__ (self, tag, program=None, pattern=None, format=None, flags=0) :
+        pattern = re.compile(pattern, flags)
+
+        self.filter = SyslogFilter(prog=program)
+
+        self.tag = tag
+        self.format = format
+        self.pattern = pattern
+
+    def apply (self, item) :
+        """
+            Apply rule against given item.
+        """
+        
+        # filter
+        match = self.filter.filter(item)
+
+        log.debug("filter: %s", match)
+
+        if not match :
+            # ignore
+            return None
+        
+        if self.pattern :
+            match = self.pattern.match(item['msg'])
+
+            if not match :
+                # ignore
+                return None
+            
+            # apply
+            item.update(match.groupdict())
+
+        if self.tag is False :
+            # drop
+            return False
+            
+        if self.format :
+            # return
+            return self.tag, self.format.format(**item)
+