[syslog-ng] Pattern DB Parser "Default Values"

[Balazs Scheidler]

Hi,

Yeah, we should probably do that.
-- 
Bazsi

On April 29, 2014 11:41:44 AM GMT+01:00, Gergely Nagy <algernon at balabit.hu> wrote:
>David Hauck <davidh at netacquire.com> writes:
>
>> I was wondering if there was a way to specify default values for
>> pattern DB parsers that include a value, but where the parsed value
>is
>> <null>[/empty]?
>>
>> In particular if I have something like the following:
>>
>>           <pattern>test message; field1=@ESTRING:field1:
>@field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4:
>@</pattern>
>>
>> I'd like to be able to do something like either, 1:
>>
>>           <pattern>test message; field1=@ESTRING:field1<foo>:
>@field2=@ESTRING:field2<bar>: @field3=@ESTRING::
>@field4=@ESTRING:field4<beef>: @</pattern>
>>
>> Or 2:
>>
>>           <pattern>test message; field1=@ESTRING:field1:
>@field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4:
>@</pattern>
>>         <values>
>>           <value name="field1.default">foo</value>
>>           <value name="field2.default">bar</value>
>>           <value name="field4.default">beef</value>
>>
>> Just curious...
>
>You can use ${field1:-foo} in templates, to set a default if none is
>set. It doesn't work for empty fields, though, but that can be worked
>around with an $(if $(length $field1) eq 0 "default" $field1) template,
>possibly in a rewrite rule.
>
>Though, maybe ${field1:-foo} should work for empty values too, not just
>unset ones (to mimic shell better, which does just that). I can make it
>do so, if that'd be desired, would make it unnecessary to use the $(if)
>hack.
>
>@Bazsi: What do you think?
>
>-- 
>|8]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20140429/e57f6594/attachment.htm