On Saturday, November 06, 2010 00:40 CET, Matthew Hall <mhall@mhcomputing.net> wrote:
I'm surprised it doesn't handle doubled delimiters right.
However I am likewise stumped. I can't find any explanation anywhere in the Balabit docs which explain what escape-* options do specifically. You´re right, that is missing. I´ll hunt down what they do, and add it to the docs.
@Bill: I can think of two possibilities that might do what you´re looking for: 1. In your template, try to specify a default value for your macros, for example, to specify a dash: {$APACHE.REFERRER:-} The problem with this is that it might not work - default values probably work only during parsing, and not when the macro is used is a template, but I think it is worth a try. If they were implemented in a universal way, it might work. 2. In syslog-ng OSE 3.2, you can use template functions and other operators to check and compare macro values. You would need to use the "if" template function to return a dash or other suitable value if your macros are empty (""). So instead of $APACHE.REFERRER, your template would look something like: $(if ("${APACHE.REFERRER}" == "") "-" $APACHE.REFERRER) See http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid... and http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid... for details. Regards, Robert
I guess reading the code is the only option for now. :/
On Fri, Nov 05, 2010 at 05:26:38PM -0600, Bill Anderson wrote:
Thanks for your reply, Mathew. Perhaps I wasn't clear enough. The syslog-ng produced logfile that logs $MSG is *just fine*. The tabs are there, and anything that parses it and expects the fields gets them just fine. The problem arises when the template only needs to log fields from the csv parser and a preceding field is empty. If there are any flags on that page that affect how the csv-parser handles empty fields, I'd appreciate them being pointed out, as I didn't see any.
Cheers, Bill
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html