summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--plugins/mmnormalize/mmnormalize.c2
-rw-r--r--runtime/msg.c18
-rw-r--r--runtime/msg.h2
-rw-r--r--runtime/rsyslog.h2
-rw-r--r--template.c18
-rw-r--r--template.h3
6 files changed, 39 insertions, 6 deletions
diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c
index 8da8f7eb..d9d64687 100644
--- a/plugins/mmnormalize/mmnormalize.c
+++ b/plugins/mmnormalize/mmnormalize.c
@@ -126,7 +126,7 @@ CODESTARTdoAction
if(r != 0) {
DBGPRINTF("error %d during ln_normalize\n", r);
}
- /***DEBUG***/
+ /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01
{
dbgprintf("mmnormalize: event ptr now is %p\n", pMsg->event);
char *cstr;
diff --git a/runtime/msg.c b/runtime/msg.c
index 5318cb75..479b2ba3 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -445,6 +445,10 @@ rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID)
*pPropID = PROP_SYS_MINUTE;
} else if(!strcmp((char*) pName, "$myhostname")) {
*pPropID = PROP_SYS_MYHOSTNAME;
+ } else if(!strcmp((char*) pName, "$!all-json")) {
+ *pPropID = PROP_CEE_ALL_JSON;
+ } else if(!strncmp((char*) pName, "$!", 2)) {
+ *pPropID = PROP_CEE;
} else {
*pPropID = PROP_INVALID;
iRet = RS_RET_VAR_NOT_FOUND;
@@ -2265,7 +2269,7 @@ static uchar *getNOW(eNOWType eNow)
*pPropLen = sizeof("**OUT OF MEMORY**") - 1; \
return(UCHAR_CONSTANT("**OUT OF MEMORY**"));}
uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
- propid_t propID, size_t *pPropLen,
+ propid_t propid, size_t *pPropLen,
unsigned short *pbMustBeFreed)
{
uchar *pRes; /* result pointer */
@@ -2274,6 +2278,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
uchar *pBuf;
int iLen;
short iOffs;
+ es_str_t *str; /* for CEE handling, temp. string */
BEGINfunc
assert(pMsg != NULL);
@@ -2287,7 +2292,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
*pbMustBeFreed = 0;
- switch(propID) {
+ switch(propid) {
case PROP_MSG:
pRes = getMSG(pMsg);
bufLen = getMSGLen(pMsg);
@@ -2420,11 +2425,18 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
case PROP_SYS_MYHOSTNAME:
pRes = glbl.GetLocalHostName();
break;
+ case PROP_CEE_ALL_JSON:
+ str = es_newStr(512);
+ ee_fmtEventToJSON(pMsg->event, &str);
+ pRes = (uchar*) es_str2cstr(str, "#000");
+ es_deleteStr(str);
+ *pbMustBeFreed = 1; /* all of these functions allocate dyn. memory */
+ break;
default:
/* there is no point in continuing, we may even otherwise render the
* error message unreadable. rgerhards, 2007-07-10
*/
- dbgprintf("invalid property id: '%d'\n", propID);
+ dbgprintf("invalid property id: '%d'\n", propid);
*pbMustBeFreed = 0;
*pPropLen = sizeof("**INVALID PROPERTY NAME**") - 1;
return UCHAR_CONSTANT("**INVALID PROPERTY NAME**");
diff --git a/runtime/msg.h b/runtime/msg.h
index b699366e..6a680da6 100644
--- a/runtime/msg.h
+++ b/runtime/msg.h
@@ -164,7 +164,7 @@ void MsgSetRawMsgWOSize(msg_t *pMsg, char* pszRawMsg);
void MsgSetRawMsg(msg_t *pMsg, char* pszRawMsg, size_t lenMsg);
rsRetVal MsgReplaceMSG(msg_t *pThis, uchar* pszMSG, int lenMSG);
uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
- propid_t propID, size_t *pPropLen, unsigned short *pbMustBeFreed);
+ propid_t propid, size_t *pPropLen, unsigned short *pbMustBeFreed);
char *textpri(char *pRes, size_t pResLen, int pri);
rsRetVal msgGetMsgVar(msg_t *pThis, cstr_t *pstrPropName, var_t **ppVar);
rsRetVal MsgEnableThreadSafety(void);
diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h
index 686b9ba1..17b20de2 100644
--- a/runtime/rsyslog.h
+++ b/runtime/rsyslog.h
@@ -136,6 +136,8 @@ typedef uintTiny propid_t;
#define PROP_SYS_QHOUR 156
#define PROP_SYS_MINUTE 157
#define PROP_SYS_MYHOSTNAME 158
+#define PROP_CEE 200
+#define PROP_CEE_ALL_JSON 201
/* The error codes below are orginally "borrowed" from
diff --git a/template.c b/template.c
index 06949e45..4a15966b 100644
--- a/template.c
+++ b/template.c
@@ -586,7 +586,14 @@ static int do_Parameter(unsigned char **pp, struct template *pTpl)
cstrDestruct(&pStrB);
return 1;
}
- cstrDestruct(&pStrB); /* no longer needed, now use ID */
+ if(pTpe->data.field.propid == PROP_CEE) {
+ /* in CEE case, we need to preserve the actual property name */
+ if((pTpe->data.field.propName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(pStrB)+2, cstrLen(pStrB)-2)) == NULL) {
+ cstrDestruct(&pStrB);
+ return 1;
+ }
+ }
+ cstrDestruct(&pStrB);
/* Check frompos, if it has an R, then topos should be a regex */
if(*p == ':') {
@@ -1073,6 +1080,8 @@ void tplDeleteAll(void)
regexp.regfree(&(pTpeDel->data.field.re));
}
}
+ if(pTpeDel->data.field.propName != NULL)
+ es_deleteStr(pTpeDel->data.field.propName);
break;
}
/*dbgprintf("\n");*/
@@ -1128,6 +1137,8 @@ void tplDeleteNew(void)
regexp.regfree(&(pTpeDel->data.field.re));
}
}
+ if(pTpeDel->data.field.propName != NULL)
+ es_deleteStr(pTpeDel->data.field.propName);
break;
}
/*dbgprintf("\n");*/
@@ -1177,6 +1188,11 @@ void tplPrintList(void)
break;
case FIELD:
dbgprintf("(FIELD), value: '%d' ", pTpe->data.field.propid);
+ if(pTpe->data.field.propid == PROP_CEE) {
+ char *cstr = es_str2cstr(pTpe->data.field.propName, NULL);
+ dbgprintf("[EE-Property: '%s'] ", cstr);
+ free(cstr);
+ }
switch(pTpe->data.field.eDateFormat) {
case tplFmtDefault:
break;
diff --git a/template.h b/template.h
index f7ac2e08..2fb8e1ae 100644
--- a/template.h
+++ b/template.h
@@ -25,6 +25,7 @@
#ifndef TEMPLATE_H_INCLUDED
#define TEMPLATE_H_INCLUDED 1
+#include <libestr.h>
#include "regexp.h"
#include "stringbuf.h"
@@ -88,6 +89,8 @@ struct templateEntry {
unsigned char field_delim; /* support for field-counting: field delemiter char */
int field_expand; /* use multiple instances of the field delimiter as a single one? */
+ es_str_t *propName; /**< property name (currently being used for CEE only) */
+
enum tplFormatTypes eDateFormat;
enum tplFormatCaseConvTypes eCaseConv;
struct { /* bit fields! */
generated by cgit (git 2.34.1) at 2024-04-23 08:30:07 +0000