----- Original message -----
This implements very basic support for type hinting template strings, where those hints will be available to value-pairs too, allowing any user of either LogTemplate or value-pairs to handle different types of values than plain strings. How they handle it, is up to the callers, this patch just lays the groundwork that makes it possible to pass these hints around.
There are a few not terribly nice solutions here, namely that the type information is encoded into the first byte of the value we store while building the value-pairs set: we do this to avoid having to allocate memory separately: we'll just reuse a byte from a ScratchBuffer. This, however, is done behind the scenes, the callback functions will get the type and value information separately.
Signed-off-by: Gergely Nagy <algernon@balabit.hu> --- lib/cfg-grammar.y | 41 ++++++++++++++++++++++--- lib/cfg-lexer.h | 5 +++ lib/filter-expr-grammar.ym | 18 ++++++++--- lib/templates.c | 28 +++++++++++++++++ lib/templates.h | 13 ++++++++ lib/value-pairs.c | 67 +++++++++++++++++++++++++++++++++-------- lib/value-pairs.h | 8 +++-- modules/afamqp/afamqp.c | 3 +- modules/afmongodb/afmongodb.c | 2 +- modules/json/format-json.c | 3 +- tests/unit/test_value_pairs.c | 6 ++-- 11 files changed, 164 insertions(+), 30 deletions(-)
diff --git a/lib/cfg-grammar.y b/lib/cfg-grammar.y index f45d486..a275aa6 100644 --- a/lib/cfg-grammar.y +++ b/lib/cfg-grammar.y @@ -370,6 +370,8 @@ ValuePairsTransformSet *last_vp_transset; %type <ptr> dest_item %type <ptr> dest_plugin +%type <tpl> template_content + %type <ptr> filter_content %type <ptr> parser_content @@ -709,12 +711,23 @@ template_items | ; +/* START_RULES */ + +template_content + : string { $$.str = $1; $$.typehint = NULL; } + | LL_IDENTIFIER '(' string ')' { $$.str = $3; $$.typehint = $1; } + ; +
can't we move template compilation here somehow? e.g. return logtemplate as a ptr?
+/* END_RULES */ + template_item - : KW_TEMPLATE '(' string ')' { + : KW_TEMPLATE '(' template_content ')' { GError *error = NULL; - CHECK_ERROR(log_template_compile(last_template, $3, &error), @3, "Error compiling template (%s)", error->message); - free($3); + CHECK_ERROR(log_template_compile(last_template, $3.str, &error), @3, "Error compiling template (%s)", error->message); + free($3.str); + CHECK_ERROR(log_template_set_type_hint(last_template, $3.typehint, &error), @3, "Error setting the template type-hint (%s)", error->message); + g_free($3.typehint); }
that way this code would be there
| KW_TEMPLATE_ESCAPE '(' yesno ')' { log_template_set_escape(last_template, $3); } ; @@ -1065,8 +1078,26 @@ vp_options ; vp_option - : KW_PAIR '(' string ':' string ')' { value_pairs_add_pair(last_value_pairs, configuration, $3, $5); free($3); free($5); } - | KW_PAIR '(' string string ')' { value_pairs_add_pair(last_value_pairs, configuration, $3, $4); free($3); free($4); } + : KW_PAIR '(' string ':' template_content ')' + { + GError *error = NULL; + + CHECK_ERROR(value_pairs_add_pair_with_type(last_value_pairs, configuration, $3, $5.typehint, $5.str, &error), + @5, "Error processing value-pair (%s)", error->message); + free($3); + g_free($5.typehint); + free($5.str); + } + | KW_PAIR '(' string template_content ')' + { + GError *error = NULL; + + CHECK_ERROR(value_pairs_add_pair_with_type(last_value_pairs, configuration, $3, $4.typehint, $4.str, &error), + @4, "Error processing value-pair (%s)", error->message); + free($3); + g_free($4.typehint); + free($4.str); + }
and these dupes would be gone.
| KW_KEY '(' string KW_REKEY '(' { last_vp_transset = value_pairs_transform_set_new($3); diff --git a/lib/cfg-lexer.h b/lib/cfg-lexer.h index 03c8a61..2030b66 100644 --- a/lib/cfg-lexer.h +++ b/lib/cfg-lexer.h @@ -65,6 +65,11 @@ typedef struct YYSTYPE char *cptr; void *ptr; gpointer node; + struct + { + gchar *str; + gchar *typehint; + } tpl; }; } YYSTYPE; #define YYSTYPE_IS_TRIVIAL 1 diff --git a/lib/filter-expr-grammar.ym b/lib/filter-expr-grammar.ym index 1efa651..0a61df2 100644 --- a/lib/filter-expr-grammar.ym +++ b/lib/filter-expr-grammar.ym @@ -174,7 +174,7 @@ filter_simple_expr } $$ = node; } - | string operator string + | template_content operator template_content { LogTemplate *left, *right; GError *error = NULL; @@ -182,13 +182,21 @@ filter_simple_expr left = log_template_new(configuration, NULL); right = log_template_new(configuration, NULL); - success_left = log_template_compile(left, $1, &error); - success_right = log_template_compile(right, $3, &error); - free($1); - free($3); + success_left = log_template_compile(left, $1.str, &error); + success_right = log_template_compile(right, $3.str, &error); + free($1.str); + free($3.str); CHECK_ERROR(success_left, @1, "error compiling template: %s", error->message); CHECK_ERROR(success_right, @3, "error compiling template: %s", error->message); + CHECK_ERROR(log_template_set_type_hint(left, $1.typehint, &error), @1, "error setting type hint on template: %s", error->message); + CHECK_ERROR(log_template_set_type_hint(right, $3.typehint, &error), @3, "error setting type hint on template: %s", error->message); + + CHECK_ERROR(left->type_hint == right->type_hint, @$, "template types (%s <-> %s) do not match", $1.typehint, $3.typehint); + + g_free($1.typehint); + g_free($3.typehint); + $$ = fop_cmp_new(left, right, $2);
most of these would be gone too.
} ; diff --git a/lib/templates.c b/lib/templates.c index f62f8b8..9be8110 100644 --- a/lib/templates.c +++ b/lib/templates.c @@ -886,6 +886,34 @@ parse_msg_ref(gchar **p, gint *msg_ref) } gboolean +log_template_set_type_hint(LogTemplate *self, const gchar *hint, GError **error) +{ + if (hint == NULL) + return TRUE; + + if (strcmp(hint, "string") == 0) + self->type_hint = TEMPLATE_TYPE_STRING; + else if (strcmp(hint, "int32") == 0 || strcmp(hint, "int") == 0) + self->type_hint = TEMPLATE_TYPE_INT32; + else if (strcmp(hint, "int64") == 0) + self->type_hint = TEMPLATE_TYPE_INT64; + else if (strcmp(hint, "datetime") == 0) + self->type_hint = TEMPLATE_TYPE_DATETIME; + else if (strcmp(hint, "boolean") == 0) + self->type_hint = TEMPLATE_TYPE_BOOLEAN; + else if (strcmp(hint, "default") == 0) + self->type_hint = TEMPLATE_TYPE_DEFAULT; + else + { + g_set_error(error, LOG_TEMPLATE_ERROR, LOG_TEMPLATE_ERROR_TYPE, + "%s", hint); + return FALSE; + } + + return TRUE; +}
I'm thinking about whether it'd make sense to configure this at runtime, and whether the list of supported values could be destination specific.
+ +gboolean log_template_compile(LogTemplate *self, const gchar *template, GError **error) { gchar *start, *p; diff --git a/lib/templates.h b/lib/templates.h index ed5b688..f3ad226 100644 --- a/lib/templates.h +++ b/lib/templates.h @@ -40,8 +40,19 @@ enum LogTemplateError { LOG_TEMPLATE_ERROR_FAILED, LOG_TEMPLATE_ERROR_COMPILE, + LOG_TEMPLATE_ERROR_TYPE, }; +typedef enum +{ + TEMPLATE_TYPE_STRING, + TEMPLATE_TYPE_BOOLEAN, + TEMPLATE_TYPE_INT32, + TEMPLATE_TYPE_INT64, + TEMPLATE_TYPE_DATETIME, + TEMPLATE_TYPE_DEFAULT, +} LogTemplateType; +
default is somehow an exception here.
/* structure that represents an expandable syslog-ng template */ typedef struct _LogTemplate { @@ -54,6 +65,7 @@ typedef struct _LogTemplate GlobalConfig *cfg; GStaticMutex arg_lock; GPtrArray *arg_bufs; + LogTemplateType type_hint; } LogTemplate; /* template expansion options that can be influenced by the user and @@ -189,6 +201,7 @@ void tf_simple_func_free_state(gpointer state); void log_template_set_escape(LogTemplate *self, gboolean enable); gboolean log_template_compile(LogTemplate *self, const gchar *template, GError **error); +gboolean log_template_set_type_hint(LogTemplate *self, const gchar *hint, GError **error); void log_template_format(LogTemplate *self, LogMessage *lm, LogTemplateOptions *opts, gint tz, gint32 seq_num, const gchar *context_id, GString *result); void log_template_append_format(LogTemplate *self, LogMessage *lm, LogTemplateOptions *opts, gint tz, gint32 seq_num, const gchar *context_id, GString *result); void log_template_append_format_with_context(LogTemplate *self, LogMessage **messages, gint num_messages, LogTemplateOptions *opts, gint tz, gint32 seq_num, const gchar *context_id, GString *result); diff --git a/lib/value-pairs.c b/lib/value-pairs.c index ee22b73..da2e391 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -151,16 +151,30 @@ value_pairs_add_glob_pattern(ValuePairs *vp, const gchar *pattern, vp->patterns[i] = p; } -void -value_pairs_add_pair(ValuePairs *vp, GlobalConfig *cfg, const gchar *key, const gchar *value) +gboolean +value_pairs_add_pair_with_type(ValuePairs *vp, GlobalConfig *cfg, + const gchar *key, const gchar *type, + const gchar *value, GError **error) { VPPairConf *p = g_new(VPPairConf, 1); p->name = g_strdup(key); p->template = log_template_new(cfg, NULL); - log_template_compile(p->template, value, NULL); + log_template_compile(p->template, value, error); + if (error && *error) + return FALSE; + log_template_set_type_hint(p->template, type, error); + if (error && *error) + return FALSE; g_ptr_array_add(vp->vpairs, p); + return TRUE; +} + +void +value_pairs_add_pair(ValuePairs *vp, GlobalConfig *cfg, const gchar *key, const gchar *value) +{ + value_pairs_add_pair_with_type(vp, cfg, key, NULL, value, NULL); } static gchar * @@ -185,6 +199,13 @@ vp_transform_apply (ValuePairs *vp, gchar *key) return ckey; } +static GString * +vp_pairs_typehint(GString *str, LogTemplateType type_hint) +{ + g_string_append_printf(str, "%c", type_hint); + return str; +} + /* runs over the name-value pairs requested by the user (e.g. with value_pairs_add_pair) */ static void vp_pairs_foreach(gpointer data, gpointer user_data) @@ -196,10 +217,11 @@ vp_pairs_foreach(gpointer data, gpointer user_data) ScratchBuffer *sb = scratch_buffer_acquire(); VPPairConf *vpc = (VPPairConf *)data; - log_template_format((LogTemplate *)vpc->template, msg, NULL, LTZ_LOCAL, - seq_num, NULL, sb_string(sb)); + vp_pairs_typehint(sb_string(sb), vpc->template->type_hint); + log_template_append_format((LogTemplate *)vpc->template, msg, NULL, LTZ_LOCAL, + seq_num, NULL, sb_string(sb)); - if (!sb_string(sb)->str[0]) + if (sb_string(sb)->len == 0) { scratch_buffer_release(sb); return; @@ -234,8 +256,13 @@ vp_msg_nvpairs_foreach(NVHandle handle, gchar *name, (log_msg_is_handle_sdata(handle) && (vp->scopes & VPS_SDATA))) || inc) { + gchar *v = g_malloc(value_len + 2); + /* NOTE: the key is a borrowed reference in the hash, and value is freed */ - g_tree_insert(scope_set, vp_transform_apply(vp, name), g_strndup(value, value_len)); + v[0] = 0; + strncpy(v + 1, value, value_len); + v[value_len + 1] = 0; + g_tree_insert(scope_set, vp_transform_apply(vp, name), v); } return FALSE; @@ -265,6 +292,7 @@ vp_merge_set(ValuePairs *vp, LogMessage *msg, gint32 seq_num, ValuePairSpec *set switch (set[i].type) { case VPT_MACRO: + vp_pairs_typehint(sb_string(sb), TEMPLATE_TYPE_STRING); log_macro_expand(sb_string(sb), set[i].id, FALSE, NULL, LTZ_LOCAL, seq_num, NULL, msg); break; case VPT_NVPAIR: @@ -272,6 +300,7 @@ vp_merge_set(ValuePairs *vp, LogMessage *msg, gint32 seq_num, ValuePairSpec *set const gchar *nv; gssize len; + vp_pairs_typehint(sb_string(sb), TEMPLATE_TYPE_STRING); nv = log_msg_get_value(msg, (NVHandle) set[i].id, &len); g_string_append_len(sb_string(sb), nv, len); break; @@ -280,7 +309,7 @@ vp_merge_set(ValuePairs *vp, LogMessage *msg, gint32 seq_num, ValuePairSpec *set g_assert_not_reached(); } - if (!sb_string(sb)->str[0]) + if (sb_string(sb)->len == 0) continue; g_tree_insert(dest, vp_transform_apply(vp, set[i].name), sb_string(sb)->str); @@ -289,12 +318,22 @@ vp_merge_set(ValuePairs *vp, LogMessage *msg, gint32 seq_num, ValuePairSpec *set scratch_buffer_release(sb); } +static gboolean +vp_foreach_helper (const gchar *name, const gchar *hinted_value, gpointer data) +{ + VPForeachFunc func = ((gpointer *)data)[0]; + gpointer user_data = ((gpointer *)data)[1]; + + return func(name, (LogTemplateType)hinted_value[0], hinted_value + 1, user_data); +} + void value_pairs_foreach_sorted (ValuePairs *vp, VPForeachFunc func, GCompareDataFunc compare_func, LogMessage *msg, gint32 seq_num, gpointer user_data) { gpointer args[] = { vp, func, msg, GINT_TO_POINTER (seq_num), user_data, NULL }; + gpointer helper_args[] = { func, user_data }; GTree *scope_set; scope_set = g_tree_new_full((GCompareDataFunc)compare_func, NULL, @@ -326,7 +365,7 @@ value_pairs_foreach_sorted (ValuePairs *vp, VPForeachFunc func, g_ptr_array_foreach(vp->vpairs, (GFunc)vp_pairs_foreach, args); /* Aaand we run it through the callback! */ - g_tree_foreach(scope_set, (GTraverseFunc)func, user_data); + g_tree_foreach(scope_set, (GTraverseFunc)vp_foreach_helper, helper_args); g_tree_destroy(scope_set); } @@ -481,7 +520,7 @@ vp_walker_name_split(vp_walk_stack_t **stack, vp_walk_state_t *state, } static gboolean -value_pairs_walker(const gchar *name, const gchar *value, +value_pairs_walker(const gchar *name, LogTemplateType type, const gchar *value, gpointer user_data) { vp_walk_state_t *state = (vp_walk_state_t *)user_data; @@ -494,10 +533,14 @@ value_pairs_walker(const gchar *name, const gchar *value, key = vp_walker_name_split (&st, state, name); if (st) - result = state->process_value(key, st->prefix, value, &st->data, + result = state->process_value(key, st->prefix, + type, value, + &st->data, state->user_data); else - result = state->process_value(key, NULL, value, NULL, + result = state->process_value(key, NULL, + type, value, + NULL, state->user_data); g_free(key); diff --git a/lib/value-pairs.h b/lib/value-pairs.h index a6c9f34..0438d53 100644 --- a/lib/value-pairs.h +++ b/lib/value-pairs.h @@ -27,12 +27,13 @@ #include "syslog-ng.h" #include "nvtable.h" +#include "templates.h" typedef struct _ValuePairs ValuePairs; -typedef gboolean (*VPForeachFunc)(const gchar *name, const gchar *value, gpointer user_data); +typedef gboolean (*VPForeachFunc)(const gchar *name, LogTemplateType type, const gchar *value, gpointer user_data); typedef gboolean (*VPWalkValueCallbackFunc)(const gchar *name, const gchar *prefix, - const gchar *value, + LogTemplateType type, const gchar *value, gpointer *prefix_data, gpointer user_data); typedef gboolean (*VPWalkCallbackFunc)(const gchar *name, const gchar *prefix, gpointer *prefix_data, @@ -42,6 +43,9 @@ typedef gboolean (*VPWalkCallbackFunc)(const gchar *name, gboolean value_pairs_add_scope(ValuePairs *vp, const gchar *scope); void value_pairs_add_glob_pattern(ValuePairs *vp, const gchar *pattern, gboolean include); void value_pairs_add_pair(ValuePairs *vp, GlobalConfig *cfg, const gchar *key, const gchar *value); +gboolean value_pairs_add_pair_with_type(ValuePairs *vp, GlobalConfig *cfg, + const gchar *key, const gchar *type, + const gchar *value, GError **error); void value_pairs_add_transforms(ValuePairs *vp, gpointer vpts); diff --git a/modules/afamqp/afamqp.c b/modules/afamqp/afamqp.c index 70fd3e8..fb3a333 100644 --- a/modules/afamqp/afamqp.c +++ b/modules/afamqp/afamqp.c @@ -374,7 +374,8 @@ afamqp_dd_connect(AMQPDestDriver *self, gboolean reconnect) */ static gboolean -afamqp_vp_foreach(const gchar *name, const gchar *value, +afamqp_vp_foreach(const gchar *name, + LogTemplateType type, const gchar *value, gpointer user_data) { amqp_table_entry_t **entries = (amqp_table_entry_t **) ((gpointer *)user_data)[0]; diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 9779097..5230d8f 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -359,7 +359,7 @@ afmongodb_vp_obj_end(const gchar *name, static gboolean afmongodb_vp_process_value(const gchar *name, const gchar *prefix, - const gchar *value, + LogTemplateType type, const gchar *value, gpointer *prefix_data, gpointer user_data) { bson *o; diff --git a/modules/json/format-json.c b/modules/json/format-json.c index d654c2e..4b79701 100644 --- a/modules/json/format-json.c +++ b/modules/json/format-json.c @@ -163,7 +163,8 @@ tf_json_obj_end(const gchar *name, } static gboolean -tf_json_value(const gchar *name, const gchar *prefix, const gchar *value, +tf_json_value(const gchar *name, const gchar *prefix, + LogTemplateType type, const gchar *value, gpointer *prefix_data, gpointer user_data) { json_state_t *state = (json_state_t *)user_data; diff --git a/tests/unit/test_value_pairs.c b/tests/unit/test_value_pairs.c index ca4ba32..3fe09de 100644 --- a/tests/unit/test_value_pairs.c +++ b/tests/unit/test_value_pairs.c @@ -10,7 +10,7 @@ gboolean success = TRUE; gboolean -vp_keys_foreach(const gchar *name, const gchar *value, gpointer user_data) +vp_keys_foreach(const gchar *name, LogTemplateType type, const gchar *value, gpointer user_data) { gpointer *args = (gpointer *) user_data; GList **keys = (GList **) args[0]; @@ -123,7 +123,7 @@ main(int argc, char *argv[]) testcase("all-nv-pairs", NULL, ".SDATA.EventData@18372.4.Data,.SDATA.Keywords@18372.4.Keyword,.SDATA.meta.sequenceId,.SDATA.meta.sysUpTime,.SDATA.origin.ip,HOST,MESSAGE,MSGID,PID,PROGRAM", NULL); - testcase("everything", NULL, ".SDATA.EventData@18372.4.Data,.SDATA.Keywords@18372.4.Keyword,.SDATA.meta.sequenceId,.SDATA.meta.sysUpTime,.SDATA.origin.ip,AMPM,BSDTAG,C_DATE,C_DAY,C_FULLDATE,C_HOUR,C_ISODATE,C_MIN,C_MONTH,C_MONTH_ABBREV,C_MONTH_NAME,C_MONTH_WEEK,C_SEC,C_STAMP,C_TZ,C_T ZOFFSET,C_UNIXTIME,C_WEEK,C_WEEKDAY,C_WEEK_DAY,C_WEEK_DAY_ABBREV,C_WEEK_DAY_NAME,C_YEAR,C_YEAR_DAY,DATE,DAY,FACILITY,FACILITY_NUM,FULLDATE,HOST,HOUR,HOUR12,ISODATE,LEVEL,LEVEL_NUM,LOGHOST,MESSAGE,MIN,MONTH,MONTH_ABBREV,MONTH_NAME,MONTH_WEEK,MSEC,MSG,MSGHDR ,MSGID,PID,PRI,PRIORITY,PROGRAM,R_AMPM,R_DATE,R_DAY,R_FULLDATE,R_HOUR,R_HOUR12,R_ISODATE,R_MIN,R_MONTH,R_MONTH_ABBREV,R_MONTH_NAME,R_MONTH_WEEK,R_MSEC,R_SEC,R_STAMP,R_TZ,R_TZOFFSET,R_UNIXTIME,R_USEC,R_WEEK,R_WEEKDAY,R_WEEK_DAY,R_WEEK_DAY_ABBREV,R_WEEK_DAY_ NAME,R_YEAR,R_YEAR_DAY,SDATA,SEC,SEQNUM,SOURCEIP,STAMP,SYSUPTIME,S_AMPM,S_DATE,S_DAY,S_FULLDATE,S_HOUR,S_HOUR12,S_ISODATE,S_MIN,S_MONTH,S_MONTH_ABBREV,S_MONTH_NAME,S_MONTH_WEEK,S_MSEC,S_SEC,S _STAMP,S _TZ,S_TZOFFSET,S_UNIXTIME,S_USEC,S_WEEK,S_WEEKDAY,S_WEEK_DAY,S_WEEK_DAY_ABBREV,S_WEEK_DAY_NAME,S_YEAR,S_YEAR_DAY,TAG,TAGS,TZ,TZOFFSET,UNIXTIME,USEC,WEEK,WEEKDAY,WEEK_DAY,WEEK_DAY_ABBREV,WEEK_DAY_NAME,YEAR,YEAR_DAY", NULL); + testcase("everything", NULL, ".SDATA.EventData@18372.4.Data,.SDATA.Keywords@18372.4.Keyword,.SDATA.meta.sequenceId,.SDATA.meta.sysUpTime,.SDATA.origin.ip,AMPM,BSDTAG,CONTEXT_ID,C_DATE,C_DAY,C_FULLDATE,C_HOUR,C_ISODATE,C_MIN,C_MONTH,C_MONTH_ABBREV,C_MONTH_NAME,C_MONTH_WEEK,C_SEC,C_STA MP,C_TZ,C_TZOFFSET,C_UNIXTIME,C_WEEK,C_WEEKDAY,C_WEEK_DAY,C_WEEK_DAY_ABBREV,C_WEEK_DAY_NAME,C_YEAR,C_YEAR_DAY,DATE,DAY,FACILITY,FACILITY_NUM,FULLDATE,HOST,HOUR,HOUR12,ISODATE,LEVEL,LEVEL_NUM,LOGHOST,MESSAGE,MIN,MONTH,MONTH_ABBREV,MONTH_NAME,MONTH_WEEK,MSEC ,MSG,MSGHDR,MSGID,PID,PRI,PRIORITY,PROGRAM,R_AMPM,R_DATE,R_DAY,R_FULLDATE,R_HOUR,R_HOUR12,R_ISODATE,R_MIN,R_MONTH,R_MONTH_ABBREV,R_MONTH_NAME,R_MONTH_WEEK,R_MSEC,R_SEC,R_STAMP,R_TZ,R_TZOFFSET,R_UNIXTIME,R_USEC,R_WEEK,R_WEEKDAY,R_WEEK_DAY,R_WEEK_DAY_ABBREV, R_WEEK_DAY_NAME,R_YEAR,R_YEAR_DAY,SDATA,SEC,SEQNUM,SOURCEIP,STAMP,SYSUPTIME,S_AMPM,S_DATE,S_DAY,S_FULLDATE,S_HOUR,S_HOUR12,S_ISODATE,S_MIN,S_MONTH,S_MONTH_ABBREV,S_MONTH_NAME,S_MONTH_WEEK,S_M SEC,S_SE C,S_STAMP,S_TZ,S_TZOFFSET,S_UNIXTIME,S_USEC,S_WEEK,S_WEEKDAY,S_WEEK_DAY,S_WEEK_DAY_ABBREV,S_WEEK_DAY_NAME,S_YEAR,S_YEAR_DAY,TAG,TAGS,TZ,TZOFFSET,UNIXTIME,USEC,WEEK,WEEKDAY,WEEK_DAY,WEEK_DAY_ABBREV,WEEK_DAY_NAME,YEAR,YEAR_DAY", NULL); testcase("nv-pairs", ".SDATA.*", "HOST,MESSAGE,MSGID,PID,PROGRAM", NULL); @@ -139,7 +139,7 @@ main(int argc, char *argv[]) g_ptr_array_add(transformers, value_pairs_new_transform_shift(2)); g_ptr_array_add(transformers, value_pairs_new_transform_replace("C_", "CC_")); - testcase("everything", NULL, ".SDATA.EventData@18372.4.Data,.SDATA.Keywords@18372.4.Keyword,.SDATA.meta.sequenceId,.SDATA.meta.sysUpTime,.SDATA.origin.ip,AMPM,BSDTAG,CC_DATE,CC_DAY,CC_FULLDATE,CC_HOUR,CC_ISODATE,CC_MIN,CC_MONTH,CC_MONTH_ABBREV,CC_MONTH_NAME,CC_MONTH_WEEK,CC_SEC,CC_ST AMP,CC_TZ,CC_TZOFFSET,CC_UNIXTIME,CC_WEEK,CC_WEEKDAY,CC_WEEK_DAY,CC_WEEK_DAY_ABBREV,CC_WEEK_DAY_NAME,CC_YEAR,CC_YEAR_DAY,DATE,DAY,FACILITY,FACILITY_NUM,FULLDATE,HOST,HOUR,HOUR12,ISODATE,LEVEL,LEVEL_NUM,LOGHOST,MESSAGE,MIN,MONTH,MONTH_ABBREV,MONTH_NAME,MONT H_WEEK,MSEC,MSG,MSGHDR,MSGID,PID,PRI,PRIORITY,PROGRAM,R_AMPM,R_DATE,R_DAY,R_FULLDATE,R_HOUR,R_HOUR12,R_ISODATE,R_MIN,R_MONTH,R_MONTH_ABBREV,R_MONTH_NAME,R_MONTH_WEEK,R_MSEC,R_SEC,R_STAMP,R_TZ,R_TZOFFSET,R_UNIXTIME,R_USEC,R_WEEK,R_WEEKDAY,R_WEEK_DAY,R_WEEK_ DAY_ABBREV,R_WEEK_DAY_NAME,R_YEAR,R_YEAR_DAY,SDATA,SEC,SEQNUM,SOURCEIP,STAMP,SYSUPTIME,S_AMPM,S_DATE,S_DAY,S_FULLDATE,S_HOUR,S_HOUR12,S_ISODATE,S_MIN,S_MONTH,S_MONTH_ABBREV,S_MONTH_NAME,S_MON TH_WEEK, S_MSEC,S_SEC,S_STAMP,S_TZ,S_TZOFFSET,S_UNIXTIME,S_USEC,S_WEEK,S_WEEKDAY,S_WEEK_DAY,S_WEEK_DAY_ABBREV,S_WEEK_DAY_NAME,S_YEAR,S_YEAR_DAY,TAG,TAGS,TZ,TZOFFSET,UNIXTIME,USEC,WEEK,WEEKDAY,WEEK_DAY,WEEK_DAY_ABBREV,WEEK_DAY_NAME,YEAR,YEAR_DAY", transformers); + testcase("everything", NULL, ".SDATA.EventData@18372.4.Data,.SDATA.Keywords@18372.4.Keyword,.SDATA.meta.sequenceId,.SDATA.meta.sysUpTime,.SDATA.origin.ip,AMPM,BSDTAG,CC_DATE,CC_DAY,CC_FULLDATE,CC_HOUR,CC_ISODATE,CC_MIN,CC_MONTH,CC_MONTH_ABBREV,CC_MONTH_NAME,CC_MONTH_WEEK,CC_SEC,CC_ST AMP,CC_TZ,CC_TZOFFSET,CC_UNIXTIME,CC_WEEK,CC_WEEKDAY,CC_WEEK_DAY,CC_WEEK_DAY_ABBREV,CC_WEEK_DAY_NAME,CC_YEAR,CC_YEAR_DAY,CONTEXT_ID,DATE,DAY,FACILITY,FACILITY_NUM,FULLDATE,HOST,HOUR,HOUR12,ISODATE,LEVEL,LEVEL_NUM,LOGHOST,MESSAGE,MIN,MONTH,MONTH_ABBREV,MONT H_NAME,MONTH_WEEK,MSEC,MSG,MSGHDR,MSGID,PID,PRI,PRIORITY,PROGRAM,R_AMPM,R_DATE,R_DAY,R_FULLDATE,R_HOUR,R_HOUR12,R_ISODATE,R_MIN,R_MONTH,R_MONTH_ABBREV,R_MONTH_NAME,R_MONTH_WEEK,R_MSEC,R_SEC,R_STAMP,R_TZ,R_TZOFFSET,R_UNIXTIME,R_USEC,R_WEEK,R_WEEKDAY,R_WEEK_ DAY,R_WEEK_DAY_ABBREV,R_WEEK_DAY_NAME,R_YEAR,R_YEAR_DAY,SDATA,SEC,SEQNUM,SOURCEIP,STAMP,SYSUPTIME,S_AMPM,S_DATE,S_DAY,S_FULLDATE,S_HOUR,S_HOUR12,S_ISODATE,S_MIN,S_MONTH,S_MONTH_ABBREV,S_MONTH _NAME,S_ MONTH_WEEK,S_MSEC,S_SEC,S_STAMP,S_TZ,S_TZOFFSET,S_UNIXTIME,S_USEC,S_WEEK,S_WEEKDAY,S_WEEK_DAY,S_WEEK_DAY_ABBREV,S_WEEK_DAY_NAME,S_YEAR,S_YEAR_DAY,TAG,TAGS,TZ,TZOFFSET,UNIXTIME,USEC,WEEK,WEEKDAY,WEEK_DAY,WEEK_DAY_ABBREV,WEEK_DAY_NAME,YEAR,YEAR_DAY", transformers); g_ptr_array_free(transformers, TRUE); app_shutdown(); -- 1.7.10.4
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq