[Lognorm] Question on special characters

[Rainer Gerhards]

Sorry...all of my time has been taken by that journald proposal. I hope to
resume regular work next week...

rainer

> -----Original Message-----
> From: lognorm-bounces at lists.adiscon.com [mailto:lognorm-
> bounces at lists.adiscon.com] On Behalf Of Lay, James
> Sent: Friday, December 02, 2011 3:52 PM
> To: lognorm at lists.adiscon.com
> Subject: Re: [Lognorm] Question on special characters
> 
> Any movement on this?  I am unable to move forward with rule creation for
> one of my devices until this is ironed out.  Thank you.
> 
> 
> 
> James
> 
> 
> 
> From: lognorm-bounces at lists.adiscon.com [mailto:lognorm-
> bounces at lists.adiscon.com] On Behalf Of Lay, James
> Sent: Thursday, November 24, 2011 11:32 AM
> To: lognorm at lists.adiscon.com
> Subject: [Lognorm] Question on special characters
> 
> 
> 
> Hey all!
> 
> 
> 
> So...I think I'm getting down to the bottom of something that I've had an
> issue with.  Here's some tests:
> 
> 
> 
> Log contents to pass to normalizer, blick.txt:
> 
> Test one)
> 
> 
> 
> Rulebase file blick-rulebase:
> 
> prefix=
> 
> rule=: Test one)
> 
> 
> 
> normalizer -r blick-rulebase < blick.txt
> 
> this works, and returns nothing, since no normalizing was required (as I
> understand it).
> 
> 
> 
> 
> 
> 
> 
> Now...if I make the below change to the blick-rulebase file:
> 
> 
> 
> prefix=
> 
> rule=: Test %-:word%)
> 
> 
> 
> normalizer -r blick-rulebase < blick.txt
> 
> [cee at 115 originalmsg=" Test one)" unparsed-data=" "]
> 
> 
> 
> Then it looks like something isn't working.
> 
> 
> 
> 
> 
> 
> 
> If I remove the ")" in both blick.txt and blick-rulebase to reflect:
> 
> Test one
> 
> 
> 
> prefix=
> 
> rule=: Test %-:word%
> 
> 
> 
> then it works:
> 
> normalizer -r blick-rulebase < blick.txt
> 
> [cee at 115 -="one"]
> 
> 
> 
> This seems to happen with matching %word% within parenthesis.  Is there
> something I can do to check this on my end?  Thank you.
> 
> 
> 
> James