[syslog-ng] greedy parser still broken?

[Jiann-Ming Su]

----- Original Message ----
> From: Balazs Scheidler <bazsi at balabit.hu>
> To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
> Sent: Mon, August 2, 2010 10:25:24 AM
> Subject: Re: [syslog-ng] greedy parser still broken?
> 
> On Fri, 2010-07-30 at 11:44 -0700, Jiann-Ming Su wrote:
> > I've reopened  bug 87 (https://bugzilla.balabit.com/show_bug.cgi?id=87) 
>because I 
>
> > think  the greedy flag is still broken.  I've updated the bug with my 
> >  observations.  Can someone else offer any more insight?   Thanks.
> 
> Can you please give us concrete examples what input you give it  and what
> your expectations are?
>

Please refer to comment #2 of the bug 
(https://bugzilla.balabit.com/show_bug.cgi?id=87#c2).

Sample syslog message:  Jul 27 19:55:33 myhost ZabbixConnector.log : 
19:55:32,782 INFO  [Thread-2834]     - [ZabbixEventSyncCommand] Processing 
message <?xml version="1.0" encoding="UTF-8"?>
The following template and parser combination: template t_esb { 
template("${ESB.LOG}, ${ESB.MSG}\n"); }; parser p_app_esb  { 
csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy)); }; 


Yields (yes, just the comma): , 

If I remove the greedy flag: ZabbixConnector.log, :

So without the greedy flag, the ESB.LOG and ESB.MSG columns are captured.  In 
this case, since the delimiter is a space (" "), the first column (ESB.LOG) is 
properly captured as "ZabbixConnector.log" and the second column (ESB.MSG) the 
next non space character, the colon (:).

With the greedy flag, I was expecting the second column (ESB.MSG) to capture the 
rest of line as well.  

ESB.LOG:  ZabbixConnector.log
ESB.MSG: : 19:55:32,782 INFO  [Thread-2834]     - [ZabbixEventSyncCommand] 
Processing message <?xml version="1.0"encoding="UTF-8"?>

But, with the greedy flag on, it seems like neither column is captured properly 
as demonstrated by only the comma(,) being printed as prescribed by the 
template.
  
> It'd be especially useful if you could  add the case to the unit test
> program (tests/unit/test_csvparser.c) by  copying & adjusting the
> examples already there.
>

Okay, I will try to get this uploaded for you.
  
> It is quite tricky  to get this right, so I'd like to avoid breaking it
> in the future.
> 


Thank you very much for your response.