[syslog-ng] [Bug 87] New: csv-parser: specifying drop-invalid and greedy flags always fails.

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=87

           Summary: csv-parser: specifying drop-invalid and greedy flags
                    always fails.
           Product: syslog-ng
           Version: 3.0.x
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi at balabit.hu
        ReportedBy: alex-pub.balabit at reflexion.net
Type of the Report: bug
   Estimated Hours: 0.0


In this example, I am trying to parse the postfix log statement.

Postfix specifies $PROGRAM as a pair separated by slash, e.g "postfix/master" or "postfix/postfix-script".
The "postfix" part is configurable, and I would like to parse it out from the $PROGRAM macro.

I tried it first with this parser

parser p_rfx_postfix_program_parser {
    csv-parser(
        columns( "POSTFIX.SERVICE_NAME", "POSTFIX.PROGRAM" )
        delimiters( "/" )
        flags( drop-invalid, escape-none, greedy )
        template( "${PROGRAM}" )
    );
};

The intention here is that ${PROGRAM} should always contain at least 1 forward slash, and I only want to parse the part before the first slash.
However this parser always fails.

Removing greedy flag makes this parser succeed, however it does change the meaning of the action that I am trying to perform.

Looking at the logparser.c: log_csv_parser_process, I've noticed that when
LOG_CSV_PARSER_GREEDY flag is on, then `cur_column` variable is reset to NULL.

Then right before the function ends it checks if `cur_column` is null and
LOG_CSV_PARSER_DROP_INVALID flag is on, then fails the function.

I think the check at the end of the function should take into account whether GREEDY operation has been performed or not.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.