[syslog-ng] CSV parser and empty fields

[Matthew Hall]

Robert definitely has some good answers here.

Another thing which occurs to me based on what he said... You could use 
match() against your empty macros, and if there is a match call set() to set 
them to a value, if the default value solution Robert proposed did not work 
due to some internal limitation of one kind or another.

Matthew.

On Saturday, November 06, 2010 12:13:57 Fekete Róbert wrote:
> On Saturday, November 06, 2010 00:40 CET, Matthew Hall 
<mhall at mhcomputing.net> wrote:
> > I'm surprised it doesn't handle doubled delimiters right.
> > 
> > However I am likewise stumped. I can't find any explanation anywhere 
in
> > the Balabit docs which explain what escape-* options do specifically.
> 
> You´re right, that is missing. I´ll hunt down what they do, and add it to
> the docs.
> 
> @Bill:
> I can think of two possibilities that might do what you´re looking for:
> 1. In your template, try to specify a default value for your macros, for
> example, to specify a dash: {$APACHE.REFERRER:-}
> The problem with this is that it might not work - default values probably
> work only during parsing, and not when the macro is used is a template,
> but I think it is worth a try. If they were implemented in a universal
> way, it might work.
> 
> 2. In syslog-ng OSE 3.2, you can use template functions and other
> operators to check and compare macro values. You would need to use 
the
> "if" template function to return a dash or other suitable value if your
> macros are empty (""). So instead of $APACHE.REFERRER, your template
> would look something like: $(if ("${APACHE.REFERRER}" == "") "-"
> $APACHE.REFERRER)
> 
> See
> http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-
> guide-admin-en.html/reference-template-functions.html and
> http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-g
> uide-admin-en.html/filters-comparing.html for details.
> 
> Regards,
> 
> Robert
> 
> > I guess reading the code is the only option for now. :/
> > 
> > On Fri, Nov 05, 2010 at 05:26:38PM -0600, Bill Anderson wrote:
> > > Thanks for your reply, Mathew. Perhaps I wasn't clear enough. The
> > > syslog-ng produced logfile that logs $MSG is *just fine*. The tabs
> > > are there, and anything that parses it and expects the fields gets
> > > them just fine. The problem arises when the template only needs to
> > > log fields from the csv parser and a preceding field is empty. If
> > > there are any flags on that page that affect how the csv-parser
> > > handles empty fields, I'd appreciate them being pointed out, as I
> > > didn't see any.
> > > 
> > > Cheers,
> > > Bill
> > 
> > _______________________________________________________________________
> > _______ Member info:
> > https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation:
> > http://www.balabit.com/support/documentation/?product=syslog-ng 
FAQ:
> > http://www.campin.net/syslog-ng/faq.html
> 
> _________________________________________________________________________
> _____ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng FAQ:
> http://www.campin.net/syslog-ng/faq.html

-- 
Matthew Hall