You clearly won't be able to use spaces as a delimiter if the value you're
capturing can contain spaces. For the values, you'll probably want to consider
the end delimiter to be either the next key (i.e. some alphanumeric chars
followed by an `=`) or EOL. And you'll need to be careful to not advance past
the next key so that you can still extract its value.
-r
On 01/05/2016 08:02 AM, Justin Vogt wrote:
Hello Heka Community,
I have a tough issue I've been trying to work on. I have some app logs
where each line is in key-value pairs that are space delimited, but some
of the values have spaces within them. I have a folding capture setup,
which works well when the values contain no spaces. Here's the entire
grammar:
local l = require "lpeg"
l.locale(l)
function extract_quote(openp,endp)
openp = l.P(openp)
endp = endp and l.P(endp) or openp
local upto_endp = (1 - endp)^0
return openp * l.C(upto_endp) * endp
end
local name = extract_quote("","=")
local value = extract_quote(""," ")
local pair = l.Cg(name * value)
grammar = l.Cf(l.Ct("") * pair^0, rawset)
And here is some sample spoofed data:
label1=sample1 lab2=samp2 id=idnum rt=timestamp host=localhost
something=[LEARN STUFF] label3=policynumber3 user=SYSTEM\\\BRO AUTHORITY
It works well up until the first space, but then things go awry. I've
tried to do some string manipulation, but that's not readily available
with captures. Any ideas, or has anyone tried something similar?
Thanks!
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
