[syslog-ng] CSV parser ignoring template()?
John Morrissey
jwm at horde.net
Mon Jan 9 17:26:54 CET 2012
On Mon, Jan 09, 2012 at 08:57:31AM -0500, John Morrissey wrote:
> On Mon, Jan 09, 2012 at 10:29:24AM +0100, Gergely Nagy wrote:
> > John Morrissey <jwm at horde.net> writes:
> > > I'm upgrading from 3.1.3 to 3.3.3. My configuration has a CSV parser:
> > >
> > > parser p_find_role {
> > > csv-parser(
> > > columns("ROLE", "REMAINDER")
> > > delimiters("0123456789.")
> > > template("${HOST}")
> > > );
> > > };
> > >
> > > With 3.1.3, this takes the first word of the machine's hostname and
> > > stores it in $ROLE, but 3.3.3 seems to ignore template() and operates
> > > on the log message instead, storing the first field of the message in
> > > $ROLE.
> > >
> > > $HOST expands correctly in a log template, so that token is still
> > > available in 3.3.x. Am I missing something else related to the
> > > upgrade?
> >
> > Are you using the same csv-parser in multiple log paths? If so, that's a
> > known bug in 3.3.x, and has since been fixed in git.
>
> nod, I forgot to mention I had already cherry-picked
> 79fc32703615e045fca4c9aaf85b7ab2915e7ed4 and applied it to our local
> syslog-ng build.
>
> That bug caused the token to be empty, but the current problem (after
> applying 79fc32) is that the token is being filled, just based on the wrong
> data.
Just tried the latest git HEAD too. It doesn't make any difference.
The CSV parser is still operating on $MSG instead of (as configured) $HOST.
john
--
John Morrissey _o /\ ---- __o
jwm at horde.net _-< \_ / \ ---- < \,
www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__
More information about the syslog-ng
mailing list