From 66ab2a70e5bcc9637dfec89c6134abe10b96dde8 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 15 Mar 2012 17:25:26 +0100 Subject: added message property parsesuccess to indicate status of higher level parser run added message property parsesuccess to indicate if the last run higher-level parser could successfully parse the message or not (see property replacer html doc for details) --- doc/property_replacer.html | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'doc') diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 6456296a..394011a1 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -138,6 +138,25 @@ draft-ietf-syslog-protocol The contents of the MSGID field from IETF draft draft-ietf-syslog-protocol + +parsesuccess +This returns the status of the last called higher level parser, +like mmjsonparse. A higher level parser parses the actual message for additional +structured data and maintains an extra property table while doing so (this is +often referred to as "cee data" because the idea was originally rooted in the +cee effort, only (but has been extended since then). Note that higher level +parsers must explicitely support (and set) this property. So, depending on the +parser, it may not be set correctly. +
If the parser properly supports it, the value "OK" means that parsing was +successfull, while "FAIL" means the parser could not successfully obtain any data. +Failure state is not necessarily an error. For example, it may simple indicate +that the cee-enhanced syslog parser (mmjsonparse) did not detect cee-enhanced format, +what can be totally valid. Using this property, further processing of the message +can be directed based on this parsing outcome. If no parser has been called at the +time this property is accessed, it will contain "FAIL". +
This property is available since version 6.3.8. + + inputname The name of the input module that generated the message (e.g. "imuxsock", "imudp"). Note that not all modules -- cgit