<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
I'll look at this little later. <br>
<br>
Do you use it in production? Is this (JSON arrays) compatible with
lognormalizer tool? Can a %tokenized field contain another
%tokenized fields (i.e., allow for recursion)? Would you write
some docs on the feature?<br>
<br>
Why do you use 'const' modifier for non-pointer arguments, for
example, 'const unsigned char c'?<br>
<br>
<br>
--<br>
Pavel<br>
<br>
<br>
<br>
30.10.2014 14:03, singh.janmejay:<br>
</div>
<blockquote
cite="mid:CAGB1VvzYqFhaGPa0=BNZ0btcjqZRryMJe1HR9ZVytAMVKTS__w@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>Hi,<br>
<br>
This patch-set introduces a log-norm field-type called
tokenized, which allows parsing of token-separated values.<br>
<br>
A lot of applications such as nginx write fields in logs
that are comma+space separated etc. For instance, nginx
upstream_addrs field writes comma-separated ip+port
combinations to access logs.<br>
<br>
Parsing such logs takes significant amount of regex and
exec-template work and leads to rather ugly solution for
something as simple as tokenized string.<br>
<br>
With this patch, parsing a list of ip-addresses separated by
', '(comma + space) for instance, would require a rule
similar to:<br>
<br>
rule=ips:%my_ips:tokenized:, :ipv4%<br>
<br>
This requires a small patch to libestr as well, so this mail
has 3 patches attached.<br>
<br>
libestr patch: <br>
<br>
0001-Changed-some-functions-that-don-t-modify-their-arg-t.patch<br>
<br>
liblognorm patch:<br>
<br>
0001-Moved-from-parser-receving-data-as-escaped-string-to.patch<br>
0002-added-support-for-field_type-tokenized-which-parses-.patch<br>
<br>
Patches go in order of prefix-number.<br clear="all">
</div>
</div>
<div>
<div>
<div>
<div>
<div>
<div><br>
-- <br>
Regards,<br>
Janmejay<br>
<a moz-do-not-send="true"
href="http://codehunk.wordpress.com">http://codehunk.wordpress.com</a><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Lognorm mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Lognorm@lists.adiscon.com">Lognorm@lists.adiscon.com</a>
<a class="moz-txt-link-freetext" href="http://lists.adiscon.net/mailman/listinfo/lognorm">http://lists.adiscon.net/mailman/listinfo/lognorm</a>
</pre>
</blockquote>
<br>
</body>
</html>