[syslog-ng] question about message parsing behavior

[Joe Shaw]

Hi,

What happens if a parser fails to parse a message?  Let's say I have a parser:

csv_parser(columns("COL1", "COL2", "COL3") delimiters(","));

If I pass in "foo", does COL1 get set to "foo" and COL2 and COL3 are undefined?

If I pass in "foo,bar" is just COL3 undefined?

If I pass in "foo,bar,baz,quux" is COL3 "baz,quux" ?

I am wondering if I can set up a filter for messages which don't meet
the parsing rules, so that I can use the catch-all directive for
logging rules and filter out messages that don't match the format (in
lieu of the tagging that was discussed in a different thread).

Thanks!

Joe