perlgrok.pl
author Peter Gervai <grin@grin.hu>
Wed, 29 Sep 2021 23:17:35 +0200
changeset 6 78c000fd2ee7
child 7 c4085453688b
permissions -rwxr-xr-x
Add perlgrok.pl: a logstash/grok compatible perl parser
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
6
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     1
#!/usr/bin/perl
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     2
# $Id: perlgrok.pl,v bca12968c007 2021/09/29 20:31:56 grin $
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     3
#
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     4
# grok parser in perl
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     5
#
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     6
# (c)Peter 'grin' Gervai, 2021; CC_BY-SA-4.0 / GPLv3+
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     7
# grin*grin.hu
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     8
#
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
     9
# This has been thrown together within half an hour, so... beware of the rough edges.
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    10
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    11
use warnings;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    12
use strict;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    13
use IO::File;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    14
use Getopt::Long;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    15
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    16
# pattern filename
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    17
my $fn_pattern = "patterns";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    18
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    19
# top pattern we resolve
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    20
my $top = "TEST";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    21
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    22
# debug level
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    23
my $DEBUG=1;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    24
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    25
my $fn_test = "-"; # STDIN
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    26
my $fn_fail;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    27
my $fn_parsed = "-"; # SDTOUT
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    28
my %input;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    29
my %processing;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    30
my $help = 0;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    31
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    32
GetOptions( 
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    33
    "input=s"       => \$fn_test,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    34
    "pattern=s"     => \$fn_pattern,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    35
    "top=s"         => \$top,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    36
    "parsed=s"      => \$fn_parsed,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    37
    "failed=s"      => \$fn_fail,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    38
    "debug=i"       => \$DEBUG,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    39
    "help"          => \$help,
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    40
) or die "error in command line arguments";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    41
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    42
if( $help ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    43
    my $VER = '$Id: perlgrok.pl,v bca12968c007 2021/09/29 20:31:56 grin $';
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    44
    print "$0 $VER (c) Peter 'grin' Gervai, 2021\n\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    45
    print "Usage: $0 [--input input_file] [--pattern pattern_file] [--top final_macro] \n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    46
    print "          [--parsed parsed_outfile] [--failed failed_lines_file] [--debug n] [--help]\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    47
    print "       defaults are stdin, stdout, 'patterns' as patternfile and 'TEST' as final macro.\n\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    48
    exit;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    49
}
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    50
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    51
# read patterns
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    52
my $f = new IO::File "< patterns" or die "cannot open patterns: $!";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    53
while( <$f> ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    54
    chomp;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    55
    # skip empty and comment lines
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    56
    next if /^ *(#|$)/;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    57
    
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    58
    # parse <name><space><content>
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    59
    if( /^(\S+) +(.+)$/ ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    60
        $input{$1} = $2;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    61
    } else {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    62
        die "Patternfile parse error:\n$_\n\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    63
    }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    64
}
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    65
$f->close;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    66
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    67
&d(5, "Start program");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    68
&resolve( $top, '<root>' );
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    69
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    70
my $res = $input{$top};
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    71
&d(9, "RESULT\n========\n${top} = $res" );
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    72
&d(9, "Pattern length=" . length($res) );
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    73
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    74
### read file
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    75
$f = new IO::File "< $fn_test" or die "cannot open $fn_test: $!";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    76
my $ff;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    77
if( $fn_fail ) { $ff = new IO::File "> $fn_fail" or die "cannot open $fn_fail for writing: $!"; }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    78
my $fout = new IO::File "> $fn_parsed" or die "cannot open output for parsed: $!";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    79
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    80
while( <$f> ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    81
    chomp;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    82
    &d(5, "LINE:$_");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    83
    if( /$res/ ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    84
        # there is a match, print parsed values
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    85
        print $fout "$_\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    86
        for my $k ( sort keys %+ ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    87
            print $fout "\t$k => '$+{$k}'\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    88
        }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    89
    } else {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    90
        if( $fn_fail ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    91
            print $ff "$_\n"  if $fn_fail ;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    92
        } else {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    93
            print "$_\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    94
            print "\t-no match-\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    95
        }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    96
    }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    97
}
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    98
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
    99
$fout->close;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   100
$f->close;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   101
$ff->close if $fn_fail;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   102
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   103
exit;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   104
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   105
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   106
#########################################################################################################
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   107
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   108
# fully resolve a macro line (recursively)
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   109
sub resolve {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   110
    my ($key, $caller_key) = @_;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   111
    
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   112
    &d( 7, "Called resolve for $key from $caller_key");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   113
    
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   114
    # get macro data from %input
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   115
    my $data = $input{$key};
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   116
    if( $processing{$key} ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   117
        # already processing this key: looping
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   118
        die "Resolving loop in $key: already processing for $processing{$key}! Called from $caller_key.";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   119
    }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   120
    $processing{$key} = $caller_key;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   121
    
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   122
    &d( 7, "Resolve_all_macros loop in $key");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   123
    # while we have unresolved macros, walk and resolve them all
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   124
    while( $data =~ /%\{(?<k>[A-Z_0-9]+)(:(?<v>[_\w\d]+))?\}/ ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   125
        my $r_key = $+{k};
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   126
        my $r_name = $+{v} || ""; # this is just informational here
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   127
        
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   128
        &d(7, "Resolve macro in $key for '$r_key' (name $r_name) in data /$data/" );
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   129
        
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   130
        # do we know the macro?
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   131
        if( defined( $input{ $r_key } ) ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   132
            # resolve everything in the macro
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   133
            &resolve( $r_key, $key );
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   134
            # replace fully resolved macro in $data
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   135
            &replace_all( \$data, $r_key );
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   136
            
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   137
        } else {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   138
            die "Unknown macro '$r_key'! Called from $caller_key.";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   139
        }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   140
    }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   141
    
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   142
    # update macro in %input with fully resolved line
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   143
    $input{$key} = $data;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   144
    &d(7, "RESOLVED '$key'! Result=/$data/");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   145
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   146
    # release loop protection for $key
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   147
    delete $processing{$key};
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   148
}
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   149
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   150
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   151
## replace all macros with replacement [macro-free] regexp
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   152
sub replace_all {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   153
    my ($data, $key) = @_;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   154
    
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   155
    &d(7, "Replace_all $key in /$$data/");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   156
    # while we have this macro in $data somewhere, repeat...
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   157
    while( $$data =~ /\{${key}(:(?<v>[_\w\d]+))?\}/ ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   158
        my $mname = $+{v};
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   159
        my $inner = $input{$key};	# shall be already resolved, may be checked (FIXME)
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   160
        
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   161
        &d(7, " Found '$key'");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   162
        
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   163
        if( $mname ) {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   164
            # named macro, create a named capture group
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   165
            $$data =~ s/%\{${key}:${mname}\}/(?<${mname}>${inner})/g;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   166
            &d(7, "  Replace $key:$mname with named capture group /$inner/");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   167
        } else {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   168
            # unnamed macro, we just throw it in (trust no1 and parenthesize it)
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   169
            $$data =~  s/%\{${key}\}/(?:${inner})/g;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   170
            &d(7, "  Replace $key with /$inner/");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   171
        }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   172
        
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   173
        &d(9, "   Replacement result is /$$data/");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   174
    }
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   175
    &d(7, "REPLACED ALL '$key' in /$$data/");
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   176
}
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   177
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   178
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   179
# extremely low-key debug subsystem :-)
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   180
sub d {
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   181
    my ($lvl, $s) = @_;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   182
    return if $lvl > $DEBUG;
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   183
    print scalar(localtime) . " [$$] ($lvl) $s\n";
78c000fd2ee7 Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff changeset
   184
}