On Tue, 2010-08-03 at 20:24 -0700, Jiann-Ming Su wrote:
----- Original Message ----
From: Jiann-Ming Su <su_js1@yahoo.com> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Sent: Tue, August 3, 2010 1:37:30 PM Subject: Re: [syslog-ng] greedy parser still broken?
----- Original Message ----
From: Balazs Scheidler <bazsi@balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Sent: Mon, August 2, 2010 10:25:24 AM Subject: Re: [syslog-ng] greedy parser still broken?
On Fri, 2010-07-30 at 11:44 -0700, Jiann-Ming Su wrote:
I've reopened bug 87 (https://bugzilla.balabit.com/show_bug.cgi?id=87) because I
think the greedy flag is still broken. I've updated the bug with my observations. Can someone else offer any more insight? Thanks.
Can you please give us concrete examples what input you give it and what your expectations are?
Please refer to comment #2 of the bug (https://bugzilla.balabit.com/show_bug.cgi?id=87#c2).
Sample syslog message: Jul 27 19:55:33 myhost ZabbixConnector.log : 19:55:32,782 INFO [Thread-2834] - [ZabbixEventSyncCommand] Processing message <?xml version="1.0" encoding="UTF-8"?> The following template and parser combination: template t_esb { template("${ESB.LOG}, ${ESB.MSG}\n"); }; parser p_app_esb { csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy)); };
I think I just fixed my own problem. I had to use the "escape-none" flag as well:
parser p_app_esb { csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy, escape-none)); };
I'm getting the behavior I'm expecting now. I'll update the bug report.
Ahh, the problem was that there was no default for the escape method, this is clearly a bug and this patch fixes it in 3.0: commit f8a8ae5ba67a4add7ed8905fba7c2118d4349b5d Author: Balazs Scheidler <bazsi@balabit.hu> Date: Fri Aug 6 13:49:59 2010 +0200 csvparser: remove the need to explicitly specify an escaping mode csvparser will not default to escape-none if it is not specified explicitly. -- Bazsi