----- Original Message ----
From: Balazs Scheidler <bazsi@balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Sent: Mon, August 2, 2010 10:25:24 AM Subject: Re: [syslog-ng] greedy parser still broken?
On Fri, 2010-07-30 at 11:44 -0700, Jiann-Ming Su wrote:
I've reopened bug 87 (https://bugzilla.balabit.com/show_bug.cgi?id=87) because I
think the greedy flag is still broken. I've updated the bug with my observations. Can someone else offer any more insight? Thanks.
Can you please give us concrete examples what input you give it and what your expectations are?
Please refer to comment #2 of the bug (https://bugzilla.balabit.com/show_bug.cgi?id=87#c2). Sample syslog message: Jul 27 19:55:33 myhost ZabbixConnector.log : 19:55:32,782 INFO [Thread-2834] - [ZabbixEventSyncCommand] Processing message <?xml version="1.0" encoding="UTF-8"?> The following template and parser combination: template t_esb { template("${ESB.LOG}, ${ESB.MSG}\n"); }; parser p_app_esb { csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy)); }; Yields (yes, just the comma): , If I remove the greedy flag: ZabbixConnector.log, : So without the greedy flag, the ESB.LOG and ESB.MSG columns are captured. In this case, since the delimiter is a space (" "), the first column (ESB.LOG) is properly captured as "ZabbixConnector.log" and the second column (ESB.MSG) the next non space character, the colon (:). With the greedy flag, I was expecting the second column (ESB.MSG) to capture the rest of line as well. ESB.LOG: ZabbixConnector.log ESB.MSG: : 19:55:32,782 INFO [Thread-2834] - [ZabbixEventSyncCommand] Processing message <?xml version="1.0"encoding="UTF-8"?> But, with the greedy flag on, it seems like neither column is captured properly as demonstrated by only the comma(,) being printed as prescribed by the template.
It'd be especially useful if you could add the case to the unit test program (tests/unit/test_csvparser.c) by copying & adjusting the examples already there.
Okay, I will try to get this uploaded for you.
It is quite tricky to get this right, so I'd like to avoid breaking it in the future.
Thank you very much for your response.