[syslog-ng] greedy parser still broken?

[Balazs Scheidler]

On Tue, 2010-08-03 at 20:24 -0700, Jiann-Ming Su wrote:
> ----- Original Message ----
> > From: Jiann-Ming Su <su_js1 at yahoo.com>
> > To: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
> > Sent: Tue, August 3, 2010 1:37:30 PM
> > Subject: Re: [syslog-ng] greedy parser still broken?
> > 
> > ----- Original Message ----
> > > From: Balazs Scheidler <bazsi at balabit.hu>
> > > To: Syslog-ng  users' and developers' mailing list 
> ><syslog-ng at lists.balabit.hu>
> > >  Sent: Mon, August 2, 2010 10:25:24 AM
> > > Subject: Re: [syslog-ng] greedy  parser still broken?
> > > 
> > > On Fri, 2010-07-30 at 11:44 -0700,  Jiann-Ming Su wrote:
> > > > I've reopened  bug 87 (https://bugzilla.balabit.com/show_bug.cgi?id=87) 
> > >because I 
> > >
> > > > think  the greedy flag is still broken.  I've  updated the bug with my 
> > > >  observations.  Can someone else  offer any more insight?   Thanks.
> > > 
> > > Can you please give us  concrete examples what input you give it  and what
> > > your  expectations are?
> > >
> > 
> > Please refer to comment #2 of the bug 
> > (https://bugzilla.balabit.com/show_bug.cgi?id=87#c2).
> > 
> > Sample syslog  message:  Jul 27 19:55:33 myhost ZabbixConnector.log : 
> > 19:55:32,782  INFO  [Thread-2834]     - [ZabbixEventSyncCommand] Processing 
> > message <?xml version="1.0" encoding="UTF-8"?>
> > The following  template and parser combination: template t_esb { 
> > template("${ESB.LOG},  ${ESB.MSG}\n"); }; parser p_app_esb  { 
> > csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") flags(greedy)); }; 
> > 
> 
> 
> I think I just fixed my own problem.  I had to use the "escape-none" flag as 
> well:
> 
> parser p_app_esb  { csv-parser(columns("ESB.LOG","ESB.MSG") delimiters(" ") 
> flags(greedy, escape-none)); };
> 
> I'm getting the behavior I'm expecting now.  I'll update the bug report.
> 

Ahh, the problem was that there was no default for the escape method,
this is clearly a bug and this patch fixes it in 3.0:

commit f8a8ae5ba67a4add7ed8905fba7c2118d4349b5d
Author: Balazs Scheidler <bazsi at balabit.hu>
Date:   Fri Aug 6 13:49:59 2010 +0200

    csvparser: remove the need to explicitly specify an escaping mode
    
    csvparser will not default to escape-none if it is not specified explicitly.




-- 
Bazsi