added new poperty replacer option, added missing documentation

- added a new property replacer option "sp-if-no-1st-sp" to cover
  a problem with RFC 3164 based interpreation of tag separation. While
  it is a generic approach, it fixes a format problem introduced in
  3.18.0, where kernel messages no longer had a space after the tag.
  This is done by a modifcation of the default templates.
  Please note that this may affect some messages where there intentionally
  is no space between the tag and the first character of the message
  content. If so, this needs to be worked around via a specific
  template. However, we consider this scenario to be quite remote and,
  even if it exists, it is not expected that it will actually cause
  problems with log parsers (instead, we assume the new default template
  behaviour may fix previous problems with log parsers due to the
  missing space).
- doc bugfix: property replacer options secpath-replace and
  secpath-drop were not documented

1 files changed, 26 insertions, 0 deletions

diff --git a/msg.c b/msg.c
index 1590a7bb..bd1e425e 100644
--- a/msg.c
+++ b/msg.c
@@ -1897,6 +1897,32 @@ char *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 #endif /* #ifdef FEATURE_REGEXP */
 	}
 
+	/* now check if we need to do our "SP if first char is non-space" hack logic */
+	if(*pRes && pTpe->data.field.options.bSPIffNo1stSP) {
+		char *pB;
+		uchar cFirst = *pRes;
+
+		/* here, we always destruct the buffer and return a new one */
+		pB = (char *) malloc(2 * sizeof(char));
+		if(pB == NULL) {
+			if(*pbMustBeFreed == 1)
+				free(pRes);
+			*pbMustBeFreed = 0;
+			return "**OUT OF MEMORY**";
+		}
+		pRes = pB;
+		*pbMustBeFreed = 1;
+
+		if(cFirst == ' ') {
+			/* if we have a SP, we must return an empty string */
+			*pRes = '\0'; /* empty */
+		} else {
+			/* if it is no SP, we need to return one */
+			*pRes = ' ';
+			*(pRes+1) = '\0';
+		}
+	}
+
 	if(*pRes) {
 		/* case conversations (should go after substring, because so we are able to
 		 * work on the smallest possible buffer).