It may seem easier, but if we have a lot of different mm modules, each to parse
one specific format, you then end up having others to parse combinations of
formats and the maintinance of having all of them (and then they all need to get
features added to them, etc)
there has been name-value-list in liblognorm since 1.1.2 according to the
changelog
looking at the test for it, it looks like it's very close to what you need
test_def $0 "name/value parser"
add_rule 'version=2'
add_rule 'rule=:%f:name-value-list%'
execute 'name=value'
assert_output_json_eq '{ "f": { "name": "value" } }'
execute 'name1=value1 name2=value2 name3=value3'
assert_output_json_eq '{ "f": { "name1": "value1", "name2": "value2", "name3":
"value3" } }'
looking in src/parser.c it seems there is a crippled parserNameValue function
to support parsing out the iptables name-value pairs (full of special cases to
make it work for iptables and not match other things), this should be able to be
generalized, documented and exposed.
see parseNameValue() and parseIPTablesNameValue()
and finally
/**
* Parser for name/value pairs.
* On entry must point to alnum char. All following chars must be
* name/value pairs delimited by whitespace up until the end of string.
* For performance reasons, this works in two stages. In the first
* stage, we only detect if the motif is correct. The second stage is
* only called when we know it is. In it, we go once again over the
* message again and actually extract the data. This is done because
* data extraction is relatively expensive and in most cases we will
* have much more frequent mismatches than matches.
* added 2015-04-25 rgerhards
*/
PARSER_Parse(NameValue)
David Lang
On Sat, 11 Aug 2018, eSX wrote:
Date: Sat, 11 Aug 2018 05:37:42 +0800
From: eSX <[email protected]>
To: David Lang <[email protected]>
Cc: eSX via rsyslog <[email protected]>
Subject: Re: [rsyslog] mmkv module
I prefer to use mmnormalize too.
IMHO, it seems there is no suited method for it?
In other words, I spent more time on mmnormalize than on writing a module :(
David Lang <[email protected]>于2018年8月11日 周六05:06写道：
Rather than creating a new mm module, can you please look to see if this
can be
done as an item type in mmnormalize? that is FAR more flexible.
David Lang
k
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
