Hello Heka Community,
I have a tough issue I've been trying to work on. I have some app logs
where each line is in key-value pairs that are space delimited, but some of
the values have spaces within them. I have a folding capture setup, which
works well when the values contain no spaces. Here's the entire grammar:
local l = require "lpeg"
l.locale(l)
function extract_quote(openp,endp)
openp = l.P(openp)
endp = endp and l.P(endp) or openp
local upto_endp = (1 - endp)^0
return openp * l.C(upto_endp) * endp
end
local name = extract_quote("","=")
local value = extract_quote(""," ")
local pair = l.Cg(name * value)
grammar = l.Cf(l.Ct("") * pair^0, rawset)
And here is some sample spoofed data:
label1=sample1 lab2=samp2 id=idnum rt=timestamp host=localhost
something=[LEARN STUFF] label3=policynumber3 user=SYSTEM\\\BRO AUTHORITY
It works well up until the first space, but then things go awry. I've tried
to do some string manipulation, but that's not readily available with
captures. Any ideas, or has anyone tried something similar?
Thanks!
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
