[syslog-ng] CSV parser ignoring template()?

[Gergely Nagy]

John Morrissey <jwm at horde.net> writes:

> I'm upgrading from 3.1.3 to 3.3.3. My configuration has a CSV parser:
>
> parser p_find_role {
>     csv-parser(
>         columns("ROLE", "REMAINDER")
>         delimiters("0123456789.")
>         template("${HOST}")
>     );
> };
>
> With 3.1.3, this takes the first word of the machine's hostname and stores
> it in $ROLE, but 3.3.3 seems to ignore template() and operates on the log
> message instead, storing the first field of the message in $ROLE.
>
> $HOST expands correctly in a log template, so that token is still available
> in 3.3.x. Am I missing something else related to the upgrade?

Are you using the same csv-parser in multiple log paths? If so, that's a
known bug in 3.3.x, and has since been fixed in git.

I would suggest giving a try to the latest git snapshot (also available
as a tarball[1], ready to ./configure && make && make install), and see
if that works.

 [1]: http://packages.madhouse-project.org/syslog-ng/3.3/syslog-ng-3.3-HEAD.tar.gz

-- 
|8]