Pattern DB Parser "Default Values"
Hi, I was wondering if there was a way to specify default values for pattern DB parsers that include a value, but where the parsed value is <null>[/empty]? In particular if I have something like the following: <pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern> I'd like to be able to do something like either, 1: <pattern>test message; field1=@ESTRING:field1<foo>: @field2=@ESTRING:field2<bar>: @field3=@ESTRING:: @field4=@ESTRING:field4<beef>: @</pattern> Or 2: <pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern> <values> <value name="field1.default">foo</value> <value name="field2.default">bar</value> <value name="field4.default">beef</value> Just curious... Thanks, -David
David Hauck <davidh@netacquire.com> writes:
I was wondering if there was a way to specify default values for pattern DB parsers that include a value, but where the parsed value is <null>[/empty]?
In particular if I have something like the following:
<pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern>
I'd like to be able to do something like either, 1:
<pattern>test message; field1=@ESTRING:field1<foo>: @field2=@ESTRING:field2<bar>: @field3=@ESTRING:: @field4=@ESTRING:field4<beef>: @</pattern>
Or 2:
<pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern> <values> <value name="field1.default">foo</value> <value name="field2.default">bar</value> <value name="field4.default">beef</value>
Just curious...
You can use ${field1:-foo} in templates, to set a default if none is set. It doesn't work for empty fields, though, but that can be worked around with an $(if $(length $field1) eq 0 "default" $field1) template, possibly in a rewrite rule. Though, maybe ${field1:-foo} should work for empty values too, not just unset ones (to mimic shell better, which does just that). I can make it do so, if that'd be desired, would make it unnecessary to use the $(if) hack. @Bazsi: What do you think? -- |8]
Hi, Yeah, we should probably do that. -- Bazsi On April 29, 2014 11:41:44 AM GMT+01:00, Gergely Nagy <algernon@balabit.hu> wrote:
David Hauck <davidh@netacquire.com> writes:
I was wondering if there was a way to specify default values for pattern DB parsers that include a value, but where the parsed value is <null>[/empty]?
In particular if I have something like the following:
<pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern>
I'd like to be able to do something like either, 1:
<pattern>test message; field1=@ESTRING:field1<foo>: @field2=@ESTRING:field2<bar>: @field3=@ESTRING:: @field4=@ESTRING:field4<beef>: @</pattern>
Or 2:
<pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern> <values> <value name="field1.default">foo</value> <value name="field2.default">bar</value> <value name="field4.default">beef</value>
Just curious...
You can use ${field1:-foo} in templates, to set a default if none is set. It doesn't work for empty fields, though, but that can be worked around with an $(if $(length $field1) eq 0 "default" $field1) template, possibly in a rewrite rule.
Though, maybe ${field1:-foo} should work for empty values too, not just unset ones (to mimic shell better, which does just that). I can make it do so, if that'd be desired, would make it unnecessary to use the $(if) hack.
@Bazsi: What do you think?
-- |8]
+1 On Tue, Apr 29, 2014 at 06:20:48PM +0100, Balazs Scheidler wrote:
Hi,
Yeah, we should probably do that. -- Bazsi
On April 29, 2014 11:41:44 AM GMT+01:00, Gergely Nagy <algernon@balabit.hu> wrote:
David Hauck <davidh@netacquire.com> writes:
I was wondering if there was a way to specify default values for pattern DB parsers that include a value, but where the parsed value is <null>[/empty]?
In particular if I have something like the following:
<pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern>
I'd like to be able to do something like either, 1:
<pattern>test message; field1=@ESTRING:field1<foo>: @field2=@ESTRING:field2<bar>: @field3=@ESTRING:: @field4=@ESTRING:field4<beef>: @</pattern>
Or 2:
<pattern>test message; field1=@ESTRING:field1: @field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4: @</pattern> <values> <value name="field1.default">foo</value> <value name="field2.default">bar</value> <value name="field4.default">beef</value>
Just curious...
You can use ${field1:-foo} in templates, to set a default if none is set. It doesn't work for empty fields, though, but that can be worked around with an $(if $(length $field1) eq 0 "default" $field1) template, possibly in a rewrite rule.
Though, maybe ${field1:-foo} should work for empty values too, not just unset ones (to mimic shell better, which does just that). I can make it do so, if that'd be desired, would make it unnecessary to use the $(if) hack.
@Bazsi: What do you think?
-- |8]
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Balazs Scheidler <bazsi@balabit.hu> writes:
Yeah, we should probably do that.
Turns out, I'll have an easy job here: it already works like that. ${BAR:-bar} will result in "bar" whether BAR is unset or empty. The tests I ran by hand were correct, but I managed to misinterpret them. So long story short: shell-style defaults work like a charm, right now, no change neccessary. -- |8]
On Wednesday, April 30, 2014 4:08 PM, you wrote:
Yeah, we should probably do that.
Turns out, I'll have an easy job here: it already works like that. ${BAR:-bar} will result in "bar" whether BAR is unset or empty. The tests I ran by hand were correct, but I managed to misinterpret them.
So long story short: shell-style defaults work like a charm, right now, no change neccessary.
;) Excellent!
participants (4)
-
Balazs Scheidler
-
David Hauck
-
Fabien Wernli
-
Gergely Nagy