Enhancement: PRI template function about syslog-ng

[bazsi]

Hmm.. what about the $FACILITY_NUM and $LEVEL_NUM macros? they extract the numeric value of the facility and severity (which is called level because of historical reasons).

Likewise, $PROGRAM and $PID is available.

Or you mean, you want to parse incoming messages that way?

[faxm0dem]

yes, my initial request was to expose the parsing procedures explicitly into template functions, so that users can use them manually in cases the syslog-protocol isn't being used.

[bazsi]

there's syslog-parser() which can be used to reparse a message as syslog formatted.

something along the lines:

parser p_xxx {
syslog-parser()
};

you can also pass flags option just like with a source:
{ "no-parse", CFH_SET, offsetof(MsgFormatOptions, flags), LP_NOPARSE },
{ "check-hostname", CFH_SET, offsetof(MsgFormatOptions, flags), LP_CHECK_HOSTNAME },
{ "syslog-protocol", CFH_SET, offsetof(MsgFormatOptions, flags), LP_SYSLOG_PROTOCOL },
{ "assume-utf8", CFH_SET, offsetof(MsgFormatOptions, flags), LP_ASSUME_UTF8 },
{ "validate-utf8", CFH_SET, offsetof(MsgFormatOptions, flags), LP_VALIDATE_UTF8 },
{ "no-multi-line", CFH_SET, offsetof(MsgFormatOptions, flags), LP_NO_MULTI_LINE },
{ "store-legacy-msghdr", CFH_SET, offsetof(MsgFormatOptions, flags), LP_STORE_LEGACY_MSGHDR },
{ "dont-store-legacy-msghdr", CFH_CLEAR, offsetof(MsgFormatOptions, flags), LP_STORE_LEGACY_MSGHDR },
{ "expect-hostname", CFH_SET, offsetof(MsgFormatOptions, flags), LP_EXPECT_HOSTNAME },
{ "no-hostname", CFH_CLEAR, offsetof(MsgFormatOptions, flags), LP_EXPECT_HOSTNAME },

[faxm0dem]

hrm okay, but will this let me parse e.g. just the PRI?

[talien]

The grok parser in the upcoming incubator release 0.4.0 can solve this problem.