[syslog-ng] CSV parser ignoring template()?

John Morrissey jwm at horde.net
Mon Jan 9 17:26:54 CET 2012


On Mon, Jan 09, 2012 at 08:57:31AM -0500, John Morrissey wrote:
> On Mon, Jan 09, 2012 at 10:29:24AM +0100, Gergely Nagy wrote:
> > John Morrissey <jwm at horde.net> writes:
> > > I'm upgrading from 3.1.3 to 3.3.3. My configuration has a CSV parser:
> > >
> > > parser p_find_role {
> > >     csv-parser(
> > >         columns("ROLE", "REMAINDER")
> > >         delimiters("0123456789.")
> > >         template("${HOST}")
> > >     );
> > > };
> > >
> > > With 3.1.3, this takes the first word of the machine's hostname and
> > > stores it in $ROLE, but 3.3.3 seems to ignore template() and operates
> > > on the log message instead, storing the first field of the message in
> > > $ROLE.
> > >
> > > $HOST expands correctly in a log template, so that token is still
> > > available in 3.3.x. Am I missing something else related to the
> > > upgrade?
> > 
> > Are you using the same csv-parser in multiple log paths? If so, that's a
> > known bug in 3.3.x, and has since been fixed in git.
> 
> nod, I forgot to mention I had already cherry-picked
> 79fc32703615e045fca4c9aaf85b7ab2915e7ed4 and applied it to our local
> syslog-ng build.
> 
> That bug caused the token to be empty, but the current problem (after
> applying 79fc32) is that the token is being filled, just based on the wrong
> data.

Just tried the latest git HEAD too. It doesn't make any difference.
The CSV parser is still operating on $MSG instead of (as configured) $HOST.

john
-- 
John Morrissey          _o            /\         ----  __o
jwm at horde.net        _-< \_          /  \       ----  <  \,
www.horde.net/    __(_)/_(_)________/    \_______(_) /_(_)__


More information about the syslog-ng mailing list