author | Peter Gervai <grin@grin.hu> |
Wed, 29 Sep 2021 23:17:35 +0200 | |
changeset 6 | 78c000fd2ee7 |
child 7 | c4085453688b |
permissions | -rwxr-xr-x |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
1 |
#!/usr/bin/perl |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
2 |
# $Id: perlgrok.pl,v bca12968c007 2021/09/29 20:31:56 grin $ |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
3 |
# |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
4 |
# grok parser in perl |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
5 |
# |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
6 |
# (c)Peter 'grin' Gervai, 2021; CC_BY-SA-4.0 / GPLv3+ |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
7 |
# grin*grin.hu |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
8 |
# |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
9 |
# This has been thrown together within half an hour, so... beware of the rough edges. |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
10 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
11 |
use warnings; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
12 |
use strict; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
13 |
use IO::File; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
14 |
use Getopt::Long; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
15 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
16 |
# pattern filename |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
17 |
my $fn_pattern = "patterns"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
18 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
19 |
# top pattern we resolve |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
20 |
my $top = "TEST"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
21 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
22 |
# debug level |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
23 |
my $DEBUG=1; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
24 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
25 |
my $fn_test = "-"; # STDIN |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
26 |
my $fn_fail; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
27 |
my $fn_parsed = "-"; # SDTOUT |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
28 |
my %input; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
29 |
my %processing; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
30 |
my $help = 0; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
31 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
32 |
GetOptions( |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
33 |
"input=s" => \$fn_test, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
34 |
"pattern=s" => \$fn_pattern, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
35 |
"top=s" => \$top, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
36 |
"parsed=s" => \$fn_parsed, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
37 |
"failed=s" => \$fn_fail, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
38 |
"debug=i" => \$DEBUG, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
39 |
"help" => \$help, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
40 |
) or die "error in command line arguments"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
41 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
42 |
if( $help ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
43 |
my $VER = '$Id: perlgrok.pl,v bca12968c007 2021/09/29 20:31:56 grin $'; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
44 |
print "$0 $VER (c) Peter 'grin' Gervai, 2021\n\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
45 |
print "Usage: $0 [--input input_file] [--pattern pattern_file] [--top final_macro] \n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
46 |
print " [--parsed parsed_outfile] [--failed failed_lines_file] [--debug n] [--help]\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
47 |
print " defaults are stdin, stdout, 'patterns' as patternfile and 'TEST' as final macro.\n\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
48 |
exit; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
49 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
50 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
51 |
# read patterns |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
52 |
my $f = new IO::File "< patterns" or die "cannot open patterns: $!"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
53 |
while( <$f> ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
54 |
chomp; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
55 |
# skip empty and comment lines |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
56 |
next if /^ *(#|$)/; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
57 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
58 |
# parse <name><space><content> |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
59 |
if( /^(\S+) +(.+)$/ ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
60 |
$input{$1} = $2; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
61 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
62 |
die "Patternfile parse error:\n$_\n\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
63 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
64 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
65 |
$f->close; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
66 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
67 |
&d(5, "Start program"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
68 |
&resolve( $top, '<root>' ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
69 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
70 |
my $res = $input{$top}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
71 |
&d(9, "RESULT\n========\n${top} = $res" ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
72 |
&d(9, "Pattern length=" . length($res) ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
73 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
74 |
### read file |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
75 |
$f = new IO::File "< $fn_test" or die "cannot open $fn_test: $!"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
76 |
my $ff; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
77 |
if( $fn_fail ) { $ff = new IO::File "> $fn_fail" or die "cannot open $fn_fail for writing: $!"; } |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
78 |
my $fout = new IO::File "> $fn_parsed" or die "cannot open output for parsed: $!"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
79 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
80 |
while( <$f> ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
81 |
chomp; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
82 |
&d(5, "LINE:$_"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
83 |
if( /$res/ ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
84 |
# there is a match, print parsed values |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
85 |
print $fout "$_\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
86 |
for my $k ( sort keys %+ ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
87 |
print $fout "\t$k => '$+{$k}'\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
88 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
89 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
90 |
if( $fn_fail ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
91 |
print $ff "$_\n" if $fn_fail ; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
92 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
93 |
print "$_\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
94 |
print "\t-no match-\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
95 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
96 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
97 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
98 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
99 |
$fout->close; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
100 |
$f->close; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
101 |
$ff->close if $fn_fail; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
102 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
103 |
exit; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
104 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
105 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
106 |
######################################################################################################### |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
107 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
108 |
# fully resolve a macro line (recursively) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
109 |
sub resolve { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
110 |
my ($key, $caller_key) = @_; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
111 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
112 |
&d( 7, "Called resolve for $key from $caller_key"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
113 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
114 |
# get macro data from %input |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
115 |
my $data = $input{$key}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
116 |
if( $processing{$key} ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
117 |
# already processing this key: looping |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
118 |
die "Resolving loop in $key: already processing for $processing{$key}! Called from $caller_key."; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
119 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
120 |
$processing{$key} = $caller_key; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
121 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
122 |
&d( 7, "Resolve_all_macros loop in $key"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
123 |
# while we have unresolved macros, walk and resolve them all |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
124 |
while( $data =~ /%\{(?<k>[A-Z_0-9]+)(:(?<v>[_\w\d]+))?\}/ ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
125 |
my $r_key = $+{k}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
126 |
my $r_name = $+{v} || ""; # this is just informational here |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
127 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
128 |
&d(7, "Resolve macro in $key for '$r_key' (name $r_name) in data /$data/" ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
129 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
130 |
# do we know the macro? |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
131 |
if( defined( $input{ $r_key } ) ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
132 |
# resolve everything in the macro |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
133 |
&resolve( $r_key, $key ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
134 |
# replace fully resolved macro in $data |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
135 |
&replace_all( \$data, $r_key ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
136 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
137 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
138 |
die "Unknown macro '$r_key'! Called from $caller_key."; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
139 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
140 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
141 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
142 |
# update macro in %input with fully resolved line |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
143 |
$input{$key} = $data; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
144 |
&d(7, "RESOLVED '$key'! Result=/$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
145 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
146 |
# release loop protection for $key |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
147 |
delete $processing{$key}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
148 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
149 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
150 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
151 |
## replace all macros with replacement [macro-free] regexp |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
152 |
sub replace_all { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
153 |
my ($data, $key) = @_; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
154 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
155 |
&d(7, "Replace_all $key in /$$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
156 |
# while we have this macro in $data somewhere, repeat... |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
157 |
while( $$data =~ /\{${key}(:(?<v>[_\w\d]+))?\}/ ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
158 |
my $mname = $+{v}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
159 |
my $inner = $input{$key}; # shall be already resolved, may be checked (FIXME) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
160 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
161 |
&d(7, " Found '$key'"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
162 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
163 |
if( $mname ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
164 |
# named macro, create a named capture group |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
165 |
$$data =~ s/%\{${key}:${mname}\}/(?<${mname}>${inner})/g; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
166 |
&d(7, " Replace $key:$mname with named capture group /$inner/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
167 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
168 |
# unnamed macro, we just throw it in (trust no1 and parenthesize it) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
169 |
$$data =~ s/%\{${key}\}/(?:${inner})/g; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
170 |
&d(7, " Replace $key with /$inner/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
171 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
172 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
173 |
&d(9, " Replacement result is /$$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
174 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
175 |
&d(7, "REPLACED ALL '$key' in /$$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
176 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
177 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
178 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
179 |
# extremely low-key debug subsystem :-) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
180 |
sub d { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
181 |
my ($lvl, $s) = @_; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
182 |
return if $lvl > $DEBUG; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
183 |
print scalar(localtime) . " [$$] ($lvl) $s\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
184 |
} |