[Lognorm] op-quoted-string with single quotes

[David Lang]

On Mon, 11 Apr 2016, Adam Williams wrote:

> Hello,
>
> I have lines like this:
>
>    app=billing description='something long in here'
>
> I'd like to use something shown in the documentation that doesn't seem
> to actually work,
> http://www.liblognorm.com/files/manual/configuration.html#string
>
>   rule=app=%app:string{"quoting.char.begin":"'",
> "quoting.char.end":"'"}%
> description=%desc:string{"quoting.char.begin":"'",
> "quoting.char.end":"'"}%
>
> However, I get the following error:
>
>    liblognorm error: invalid field type 'string{"quoting.char.begin"'
>
> Then I find that we're told there is no string type:
> https://github.com/rsyslog/liblognorm/issues/169
>
> This led me to attempt:
>
>    op-quoted-string{"quoting.char.begin":"'", "quoting.char.end":"'"}
>    liblognorm error: invalid field type 'op-quoted-string{"quoting.char.begin"'
>
> Is it possible to accomplish what I need to accomplish? Thanks!

This syntax only works with the unreleased version 2 of liblognorm.

First make sure that you are running that (It is available in the nightly 
releases), and then make sure you have version=2 as the first line of your 
ruleset.

I've been running it for a few months in production, and it is significantly 
more powerful than version 1. I believe that the plan is to release version 2 in 
the next week or so along with rsyslog 8.18, but it could slip one more release.

David Lang