----- Original Message ----
From: Jiann-Ming Su <su_js1@yahoo.com> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Sent: Tue, August 3, 2010 1:37:30 PM Subject: Re: [syslog-ng] greedy parser still broken?
----- Original Message ----
From: Balazs Scheidler <bazsi@balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Sent: Mon, August 2, 2010 10:25:24 AM Subject: Re: [syslog-ng] greedy parser still broken?
On Fri, 2010-07-30 at 11:44 -0700, Jiann-Ming Su wrote:
I've reopened bug 87 (https://bugzilla.balabit.com/show_bug.cgi?id=87) because I
think the greedy flag is still broken. I've updated the bug with my observations. Can someone else offer any more insight? Thanks.
Can you please give us concrete examples what input you give it and what your expectations are?
Please refer to comment #2 of the bug (https://bugzilla.balabit.com/show_bug.cgi?id=87#c2).
Sample syslog message: Jul 27 19:55:33 myhost ZabbixConnector.log : 19:55:32,782 INFO [Thread-2834] - [ZabbixEventSyncCommand] Processing message <?xml version="1.0" encoding="UTF-8"?> The following template and parser combination: template t_esb { template("${ESB.LOG}, ${ESB.MSG}\n"); }; parser p_app_esb { csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy)); };
I think I just fixed my own problem. I had to use the "escape-none" flag as well: parser p_app_esb { csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy, escape-none)); }; I'm getting the behavior I'm expecting now. I'll update the bug report.