[syslog-ng] Pattern DB Parser "Default Values"

[Fabien Wernli]

+1

On Tue, Apr 29, 2014 at 06:20:48PM +0100, Balazs Scheidler wrote:
> Hi,
> 
> Yeah, we should probably do that.
> -- 
> Bazsi
> 
> On April 29, 2014 11:41:44 AM GMT+01:00, Gergely Nagy <algernon at balabit.hu> wrote:
> >David Hauck <davidh at netacquire.com> writes:
> >
> >> I was wondering if there was a way to specify default values for
> >> pattern DB parsers that include a value, but where the parsed value
> >is
> >> <null>[/empty]?
> >>
> >> In particular if I have something like the following:
> >>
> >>           <pattern>test message; field1=@ESTRING:field1:
> >@field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4:
> >@</pattern>
> >>
> >> I'd like to be able to do something like either, 1:
> >>
> >>           <pattern>test message; field1=@ESTRING:field1<foo>:
> >@field2=@ESTRING:field2<bar>: @field3=@ESTRING::
> >@field4=@ESTRING:field4<beef>: @</pattern>
> >>
> >> Or 2:
> >>
> >>           <pattern>test message; field1=@ESTRING:field1:
> >@field2=@ESTRING:field2: @field3=@ESTRING:: @field4=@ESTRING:field4:
> >@</pattern>
> >>         <values>
> >>           <value name="field1.default">foo</value>
> >>           <value name="field2.default">bar</value>
> >>           <value name="field4.default">beef</value>
> >>
> >> Just curious...
> >
> >You can use ${field1:-foo} in templates, to set a default if none is
> >set. It doesn't work for empty fields, though, but that can be worked
> >around with an $(if $(length $field1) eq 0 "default" $field1) template,
> >possibly in a rewrite rule.
> >
> >Though, maybe ${field1:-foo} should work for empty values too, not just
> >unset ones (to mimic shell better, which does just that). I can make it
> >do so, if that'd be desired, would make it unnecessary to use the $(if)
> >hack.
> >
> >@Bazsi: What do you think?
> >
> >-- 
> >|8]

> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>