diff options
author | Rainer Gerhards <rgerhards@adiscon.com> | 2010-12-01 10:19:50 +0100 |
---|---|---|
committer | Rainer Gerhards <rgerhards@adiscon.com> | 2010-12-01 10:19:50 +0100 |
commit | 471f07f45a382c29f74e1c676bd081c3b304d7db (patch) | |
tree | 71c6fa49bbeef19e13651f1289e995412f621072 | |
parent | cbfa21f8230d211cc1dfc3284c8d4437b6c5ebc1 (diff) | |
download | rsyslog-471f07f45a382c29f74e1c676bd081c3b304d7db.tar.gz rsyslog-471f07f45a382c29f74e1c676bd081c3b304d7db.tar.xz rsyslog-471f07f45a382c29f74e1c676bd081c3b304d7db.zip |
milestone: template supports CEE output via %$!all-json%
-rw-r--r-- | plugins/mmnormalize/mmnormalize.c | 2 | ||||
-rw-r--r-- | runtime/msg.c | 18 | ||||
-rw-r--r-- | runtime/msg.h | 2 | ||||
-rw-r--r-- | runtime/rsyslog.h | 2 | ||||
-rw-r--r-- | template.c | 18 | ||||
-rw-r--r-- | template.h | 3 |
6 files changed, 39 insertions, 6 deletions
diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 8da8f7eb..d9d64687 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -126,7 +126,7 @@ CODESTARTdoAction if(r != 0) { DBGPRINTF("error %d during ln_normalize\n", r); } - /***DEBUG***/ + /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01 { dbgprintf("mmnormalize: event ptr now is %p\n", pMsg->event); char *cstr; diff --git a/runtime/msg.c b/runtime/msg.c index 5318cb75..479b2ba3 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -445,6 +445,10 @@ rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID) *pPropID = PROP_SYS_MINUTE; } else if(!strcmp((char*) pName, "$myhostname")) { *pPropID = PROP_SYS_MYHOSTNAME; + } else if(!strcmp((char*) pName, "$!all-json")) { + *pPropID = PROP_CEE_ALL_JSON; + } else if(!strncmp((char*) pName, "$!", 2)) { + *pPropID = PROP_CEE; } else { *pPropID = PROP_INVALID; iRet = RS_RET_VAR_NOT_FOUND; @@ -2265,7 +2269,7 @@ static uchar *getNOW(eNOWType eNow) *pPropLen = sizeof("**OUT OF MEMORY**") - 1; \ return(UCHAR_CONSTANT("**OUT OF MEMORY**"));} uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, - propid_t propID, size_t *pPropLen, + propid_t propid, size_t *pPropLen, unsigned short *pbMustBeFreed) { uchar *pRes; /* result pointer */ @@ -2274,6 +2278,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, uchar *pBuf; int iLen; short iOffs; + es_str_t *str; /* for CEE handling, temp. string */ BEGINfunc assert(pMsg != NULL); @@ -2287,7 +2292,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, *pbMustBeFreed = 0; - switch(propID) { + switch(propid) { case PROP_MSG: pRes = getMSG(pMsg); bufLen = getMSGLen(pMsg); @@ -2420,11 +2425,18 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, case PROP_SYS_MYHOSTNAME: pRes = glbl.GetLocalHostName(); break; + case PROP_CEE_ALL_JSON: + str = es_newStr(512); + ee_fmtEventToJSON(pMsg->event, &str); + pRes = (uchar*) es_str2cstr(str, "#000"); + es_deleteStr(str); + *pbMustBeFreed = 1; /* all of these functions allocate dyn. memory */ + break; default: /* there is no point in continuing, we may even otherwise render the * error message unreadable. rgerhards, 2007-07-10 */ - dbgprintf("invalid property id: '%d'\n", propID); + dbgprintf("invalid property id: '%d'\n", propid); *pbMustBeFreed = 0; *pPropLen = sizeof("**INVALID PROPERTY NAME**") - 1; return UCHAR_CONSTANT("**INVALID PROPERTY NAME**"); diff --git a/runtime/msg.h b/runtime/msg.h index b699366e..6a680da6 100644 --- a/runtime/msg.h +++ b/runtime/msg.h @@ -164,7 +164,7 @@ void MsgSetRawMsgWOSize(msg_t *pMsg, char* pszRawMsg); void MsgSetRawMsg(msg_t *pMsg, char* pszRawMsg, size_t lenMsg); rsRetVal MsgReplaceMSG(msg_t *pThis, uchar* pszMSG, int lenMSG); uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, - propid_t propID, size_t *pPropLen, unsigned short *pbMustBeFreed); + propid_t propid, size_t *pPropLen, unsigned short *pbMustBeFreed); char *textpri(char *pRes, size_t pResLen, int pri); rsRetVal msgGetMsgVar(msg_t *pThis, cstr_t *pstrPropName, var_t **ppVar); rsRetVal MsgEnableThreadSafety(void); diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h index 686b9ba1..17b20de2 100644 --- a/runtime/rsyslog.h +++ b/runtime/rsyslog.h @@ -136,6 +136,8 @@ typedef uintTiny propid_t; #define PROP_SYS_QHOUR 156 #define PROP_SYS_MINUTE 157 #define PROP_SYS_MYHOSTNAME 158 +#define PROP_CEE 200 +#define PROP_CEE_ALL_JSON 201 /* The error codes below are orginally "borrowed" from @@ -586,7 +586,14 @@ static int do_Parameter(unsigned char **pp, struct template *pTpl) cstrDestruct(&pStrB); return 1; } - cstrDestruct(&pStrB); /* no longer needed, now use ID */ + if(pTpe->data.field.propid == PROP_CEE) { + /* in CEE case, we need to preserve the actual property name */ + if((pTpe->data.field.propName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(pStrB)+2, cstrLen(pStrB)-2)) == NULL) { + cstrDestruct(&pStrB); + return 1; + } + } + cstrDestruct(&pStrB); /* Check frompos, if it has an R, then topos should be a regex */ if(*p == ':') { @@ -1073,6 +1080,8 @@ void tplDeleteAll(void) regexp.regfree(&(pTpeDel->data.field.re)); } } + if(pTpeDel->data.field.propName != NULL) + es_deleteStr(pTpeDel->data.field.propName); break; } /*dbgprintf("\n");*/ @@ -1128,6 +1137,8 @@ void tplDeleteNew(void) regexp.regfree(&(pTpeDel->data.field.re)); } } + if(pTpeDel->data.field.propName != NULL) + es_deleteStr(pTpeDel->data.field.propName); break; } /*dbgprintf("\n");*/ @@ -1177,6 +1188,11 @@ void tplPrintList(void) break; case FIELD: dbgprintf("(FIELD), value: '%d' ", pTpe->data.field.propid); + if(pTpe->data.field.propid == PROP_CEE) { + char *cstr = es_str2cstr(pTpe->data.field.propName, NULL); + dbgprintf("[EE-Property: '%s'] ", cstr); + free(cstr); + } switch(pTpe->data.field.eDateFormat) { case tplFmtDefault: break; @@ -25,6 +25,7 @@ #ifndef TEMPLATE_H_INCLUDED #define TEMPLATE_H_INCLUDED 1 +#include <libestr.h> #include "regexp.h" #include "stringbuf.h" @@ -88,6 +89,8 @@ struct templateEntry { unsigned char field_delim; /* support for field-counting: field delemiter char */ int field_expand; /* use multiple instances of the field delimiter as a single one? */ + es_str_t *propName; /**< property name (currently being used for CEE only) */ + enum tplFormatTypes eDateFormat; enum tplFormatCaseConvTypes eCaseConv; struct { /* bit fields! */ |