Github user justinleet commented on a diff in the pull request:
https://github.com/apache/metron/pull/1175#discussion_r212985523
--- Diff:
metron-platform/metron-parsers/src/main/java/org/apache/metron/parsers/syslog/Syslog5424Parser.java
---
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.metron.parsers.syslog;
+
+import com.github.palindromicity.syslog.NilPolicy;
+import com.github.palindromicity.syslog.SyslogParser;
+import com.github.palindromicity.syslog.SyslogParserBuilder;
+import com.github.palindromicity.syslog.dsl.SyslogFieldKeys;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import org.apache.metron.parsers.BasicParser;
+import org.json.simple.JSONObject;
+
+
+
+/**
+ * Parser for well structured RFC 5424 messages.
+ */
+public class Syslog5424Parser extends BasicParser {
+ public static final String NIL_POLICY_CONFIG = "nilPolicy";
+ /**
+ * The NilPolicy specifies how the parser handles missing fields in the
return
+ * It can:
+ * Omit the fields
+ * Have a value of '-' ( as spec )
+ * Have null values for the fields
+ * <p>The default is to omit the fields from the return set.</p>
+ */
+ private NilPolicy nilPolicy = NilPolicy.OMIT;
+
+ @Override
+ public void configure(Map<String, Object> config) {
+ String nilPolicyStr = (String)
config.getOrDefault(NIL_POLICY_CONFIG,NilPolicy.OMIT.name());
+ nilPolicy = NilPolicy.valueOf(nilPolicyStr);
+ }
+
+ @Override
+ public void init() {
+ }
+
+ @Override
+ @SuppressWarnings("unchecked")
+ public List<JSONObject> parse(byte[] rawMessage) {
+ try {
+ if (rawMessage == null || rawMessage.length == 0) {
+ return null;
+ }
+
+ String originalString = new String(rawMessage);
+
+ SyslogParser parser = new
SyslogParserBuilder().withNilPolicy(nilPolicy).build();
--- End diff --
This is half comment, half question.
It seems odd to recreate the SyslogParserBuilder every `parser`. I dug in a
bit, and I expected (personally expected, not "Metron itself expects x
condition") this process to be somewhat similar to the enrichment where the
bolt implements the `reloadCallback` method (e.g.
[UnifiedEnrichmentBolt](https://github.com/apache/metron/blob/1d95b8316a18097747be116a0276c56b894fb79c/metron-platform/metron-enrichment/src/main/java/org/apache/metron/enrichment/bolt/UnifiedEnrichmentBolt.java#L229))
which would then delegate updating the config of the underlying pieces.
E.g. here I would expect the `SyslogParser` to be created a priori and then
when the parser config gets updated `reloadCallback` would be called and this
would be updated (and in this case recreated).
Looking into it a bit further, it looks like ParserBolt has the appropriate
method passed down to it, but chooses not to implement it. I suspect it's
because nothing the underlying parsers don't update configs, although I didn't
check all of them.
Would it be reasonable to get that setup in the ParserBolt and then handle
the `SyslogParser` object that way, rather than recreating it every time?
---
