[syslog-ng] CSV parser and empty fields

[Balazs Scheidler]

On Sat, 2010-11-06 at 20:13 +0100, Fekete Róbert wrote:
> On Saturday, November 06, 2010 00:40 CET, Matthew Hall <mhall at mhcomputing.net> wrote: 
>  
> > I'm surprised it doesn't handle doubled delimiters right.
> > 
> > However I am likewise stumped. I can't find any explanation anywhere in 
> > the Balabit docs which explain what escape-* options do specifically.
> You´re right, that is missing. I´ll hunt down what they do, and add it to the docs.
> 
> @Bill:
> I can think of two possibilities that might do what you´re looking for:
> 1. In your template, try to specify a default value for your macros, for example, to specify a dash: 
> {$APACHE.REFERRER:-}
> The problem with this is that it might not work - default values probably work only during parsing, 
> and not when the macro is used is a template, but I think it is worth a try. If they were 
> implemented in a universal way, it might work.

Robert, I don't exactly understand what refer to here. The default
expansion work everywhere a template is used. E.g. if you have an empty
value, you can assign a default to it within the template. But when
expanding a template an undefined name-value pair becomes an empty
string.

E.g. ${APACHE.REFERER} and ${APACHE.REFERER:-} is the same, since if
APACHE.REFERER is not defined both become the empty string. And if it is
defined, both become the value stored in APACHE.REFERER.

> 
> 2. In syslog-ng OSE 3.2, you can use template functions and other operators to check and compare macro values. You would need to use the "if" template function to return a dash or other suitable value if your macros are empty (""). So instead of $APACHE.REFERRER, your template would look something like:
> $(if ("${APACHE.REFERRER}" == "") "-" $APACHE.REFERRER)
> 
> See http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guide-admin-en.html/reference-template-functions.html
> and 
> http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guide-admin-en.html/filters-comparing.html
> for details.

-- 
Bazsi