AddContextualDataSelector * add_contextual_data_template_selector_new(GlobalConfig *cfg, const gchar *selector_template_string) { AddContextualDataTemplateSelector *new_instance = g_new0(AddContextualDataTemplateSelector, 1); new_instance->selector_template_string = g_strdup(selector_template_string); new_instance->selector_template = log_template_new(cfg, NULL); new_instance->super.resolve = _resolve; new_instance->super.free = _free; new_instance->super.init = _init; new_instance->super.clone = _clone; return &new_instance->super; }
LogRewrite * log_rewrite_set_new(const gchar *new_value) { LogRewriteSet *self = g_new0(LogRewriteSet, 1); log_rewrite_init(&self->super); self->super.free_fn = log_rewrite_set_free; self->super.process = log_rewrite_set_process; self->value_template = log_template_new(configuration, NULL, new_value); return &self->super; }
LogRewrite * log_rewrite_subst_new(const gchar *replacement) { LogRewriteSubst *self = g_new0(LogRewriteSubst, 1); log_rewrite_init(&self->super); self->super.free_fn = log_rewrite_subst_free; self->super.process = log_rewrite_subst_process; self->replacement = log_template_new(configuration, NULL, replacement); return &self->super; }
int testcase_replace(const gchar *log, const gchar *re, gchar *replacement, const gchar *expected_result, const gint matcher_flags, LogMatcher *m) { LogMessage *msg; LogTemplate *r; gchar *result; gssize length; gchar buf[1024]; gssize msglen; NVHandle nonasciiz = log_msg_get_value_handle("NON-ASCIIZ"); const gchar *value; GSockAddr *sa; sa = g_sockaddr_inet_new("10.10.10.10", 1010); msg = log_msg_new(log, strlen(log), sa, &parse_options); g_sockaddr_unref(sa); /* NOTE: we test how our matchers cope with non-zero terminated values. We don't change message_len, only the value */ g_snprintf(buf, sizeof(buf), "%sAAAAAAAAAAAA", log_msg_get_value(msg, LM_V_MESSAGE, &msglen)); log_msg_set_value(msg, log_msg_get_value_handle("MESSAGE2"), buf, -1); /* add a non-zero terminated indirect value which contains the whole message */ log_msg_set_value_indirect(msg, nonasciiz, log_msg_get_value_handle("MESSAGE2"), 0, 0, msglen); log_matcher_set_flags(m, matcher_flags); log_matcher_compile(m, re); r = log_template_new(configuration, NULL); log_template_compile(r, replacement, NULL); NVTable *nv_table = nv_table_ref(msg->payload); value = log_msg_get_value(msg, nonasciiz, &msglen); result = log_matcher_replace(m, msg, nonasciiz, value, msglen, r, &length); value = log_msg_get_value(msg, nonasciiz, &msglen); nv_table_unref(nv_table); if (strncmp(result ? result : value, expected_result, result ? length : msglen) != 0) { fprintf(stderr, "Testcase failure. pattern=%s, result=%.*s, expected=%s\n", re, (gint) length, result ? result : value, expected_result); exit(1); } g_free(result); log_template_unref(r); log_matcher_unref(m); log_msg_unref(msg); return 0; }
gboolean synthetic_message_add_value_template_string(SyntheticMessage *self, GlobalConfig *cfg, const gchar *name, const gchar *value, GError **error) { LogTemplate *value_template; gboolean result = FALSE; /* NOTE: we shouldn't use the name property for LogTemplate structs, see the comment at log_template_set_name() */ value_template = log_template_new(cfg, name); if (log_template_compile(value_template, value, error)) { synthetic_message_add_value_template(self, name, value_template); result = TRUE; } log_template_unref(value_template); return result; }
void test_pattern(const gchar *pattern, const gchar *rule, gboolean match) { gboolean result; LogMessage *msg = log_msg_new_empty(); static LogTemplate *templ; GString *res = g_string_sized_new(128); static TimeZoneInfo *tzinfo = NULL; PDBInput input; if (!tzinfo) tzinfo = time_zone_info_new(NULL); if (!templ) { templ = log_template_new(configuration, "dummy"); log_template_compile(templ, "$TEST", NULL); } log_msg_set_value(msg, LM_V_HOST, MYHOST, strlen(MYHOST)); log_msg_set_value(msg, LM_V_PROGRAM, "test", strlen(MYHOST)); log_msg_set_value(msg, LM_V_MESSAGE, pattern, strlen(pattern)); result = pattern_db_process(patterndb, PDB_INPUT_WRAP_MESSAGE(&input, msg)); log_template_format(templ, msg, NULL, LTZ_LOCAL, 0, NULL, res); if (strcmp(res->str, pattern) == 0) { test_msg("Rule: '%s' Value '%s' is inserted into $TEST res:(%s)\n", rule, pattern, res->str); } if ((match && !result) || (!match && result)) { test_fail("FAIL: Value '%s' is %smatching for pattern '%s' \n", rule, !!result ? "" : "not ", pattern); } else { test_msg("Value '%s' is %smatching for pattern '%s' \n", rule, !!result ? "" : "not ", pattern); } g_string_free(res, TRUE); log_msg_unref(msg); }
LogDriver * afamqp_dd_new(GlobalConfig *cfg) { AMQPDestDriver *self = g_new0(AMQPDestDriver, 1); log_threaded_dest_driver_init_instance(&self->super); self->super.super.super.super.init = afamqp_dd_init; self->super.super.super.super.free_fn = afamqp_dd_free; self->super.worker.thread_init = afamqp_worker_thread_init; self->super.worker.disconnect = afamqp_dd_disconnect; self->super.worker.insert = afamqp_worker_insert; self->super.format.stats_instance = afamqp_dd_format_stats_instance; self->super.format.persist_name = afamqp_dd_format_persist_name; self->super.stats_source = SCS_AMQP; self->routing_key_template = log_template_new(cfg, NULL); afamqp_dd_set_vhost((LogDriver *) self, "/"); afamqp_dd_set_host((LogDriver *) self, "127.0.0.1"); afamqp_dd_set_port((LogDriver *) self, 5672); afamqp_dd_set_exchange((LogDriver *) self, "syslog"); afamqp_dd_set_exchange_type((LogDriver *) self, "fanout"); afamqp_dd_set_routing_key((LogDriver *) self, ""); afamqp_dd_set_persistent((LogDriver *) self, TRUE); afamqp_dd_set_exchange_declare((LogDriver *) self, FALSE); init_sequence_number(&self->seq_num); self->max_entries = 256; self->entries = g_new(amqp_table_entry_t, self->max_entries); log_template_options_defaults(&self->template_options); afamqp_dd_set_value_pairs(&self->super.super.super, value_pairs_new_default(cfg)); return (LogDriver *) self; }
#include <string.h> gboolean success = TRUE; gboolean verbose = FALSE; MsgFormatOptions parse_options; void testcase(LogMessage *msg, gchar *template, gchar *expected) { LogTemplate *templ; GString *res = g_string_sized_new(128); GError *error = NULL; LogMessage *context[2] = { msg, msg }; const gchar *context_id = "test-context-id"; templ = log_template_new(configuration, "dummy"); if (!log_template_compile(templ, template, &error)) { fprintf(stderr, "FAIL: error compiling template, template=%s, error=%s\n", template, error->message); g_clear_error(&error); success = FALSE; goto error; } log_template_format_with_context(templ, context, 2, NULL, LTZ_LOCAL, 999, context_id, res); if (strcmp(res->str, expected) != 0) { fprintf(stderr, "FAIL: template test failed, template=%s, [%s] <=> [%s]\n", template, res->str, expected); success = FALSE; } else if (verbose)
log_msg_set_value_by_name(msg, ".unix.gid", "1000", -1); log_msg_set_value_by_name(msg, ".unix.cmd", "command", -1); log_msg_set_value_by_name(msg, ".json.foo", "bar", -1); log_msg_set_value_by_name(msg, ".json.sub.value1", "subvalue1", -1); log_msg_set_value_by_name(msg, ".json.sub.value2", "subvalue2", -1); log_msg_set_value_by_name(msg, "escaping", "binary stuff follows \"\xad árvíztűrőtükörfúrógép", -1); log_msg_set_value_by_name(msg, "escaping2", "\xc3", -1); log_msg_set_value_by_name(msg, "null", "binary\0stuff", 12); return msg; } LogTemplate * compile_template(const gchar *template, gboolean escaping) { LogTemplate *templ = log_template_new(configuration, NULL); gboolean success; GError *error = NULL; log_template_set_escape(templ, escaping); success = log_template_compile(templ, template, &error); expect_true(success, "template expected to compile cleanly," " but it didn't, template=%s, error=%s", template, error ? error->message : "(none)"); g_clear_error(&error); return templ; } void assert_template_format(const gchar *template, const gchar *expected)