author | Peter Gervai <grin@grin.hu> |
Wed, 15 May 2024 09:50:23 +0200 | |
changeset 14 | d2d8803e35ec |
parent 11 | 5c38653bd7e7 |
permissions | -rwxr-xr-x |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
1 |
#!/usr/bin/perl |
11
5c38653bd7e7
perlgrok.pl: sanitize labels even if there was no macro replacement (manual capture groups)
Peter Gervai <grin@grin.hu>
parents:
10
diff
changeset
|
2 |
# $Id: perlgrok.pl,v 43b8b0709ac5 2021/10/02 13:03:51 grin $ |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
3 |
# |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
4 |
# grok parser in perl |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
5 |
# |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
6 |
# (c)Peter 'grin' Gervai, 2021; CC_BY-SA-4.0 / GPLv3+ |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
7 |
# grin*grin.hu |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
8 |
# |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
9 |
# This has been thrown together within half an hour, so... beware of the rough edges. |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
10 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
11 |
use warnings; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
12 |
use strict; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
13 |
use IO::File; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
14 |
use Getopt::Long; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
15 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
16 |
# pattern filename |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
17 |
my @fn_patterns = (); |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
18 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
19 |
# top pattern we resolve |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
20 |
my $top = "TEST"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
21 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
22 |
# debug level |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
23 |
my $DEBUG=1; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
24 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
25 |
my $fn_test = "-"; # STDIN |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
26 |
my $fn_fail; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
27 |
my $fn_parsed = "-"; # SDTOUT |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
28 |
my %input; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
29 |
my %processing; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
30 |
my $help = 0; |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
31 |
my $re_trace = 1; # check all regexp |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
32 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
33 |
my %xlate; # perl names don't support period in name, so we need to translate |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
34 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
35 |
GetOptions( |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
36 |
"input=s" => \$fn_test, |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
37 |
"pattern=s" => \@fn_patterns, |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
38 |
"top=s" => \$top, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
39 |
"parsed=s" => \$fn_parsed, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
40 |
"failed=s" => \$fn_fail, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
41 |
"debug=i" => \$DEBUG, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
42 |
"help" => \$help, |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
43 |
) or die "error in command line arguments"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
44 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
45 |
if( $help ) { |
11
5c38653bd7e7
perlgrok.pl: sanitize labels even if there was no macro replacement (manual capture groups)
Peter Gervai <grin@grin.hu>
parents:
10
diff
changeset
|
46 |
my $VER = '$Id: perlgrok.pl,v 43b8b0709ac5 2021/10/02 13:03:51 grin $'; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
47 |
print "$0 $VER (c) Peter 'grin' Gervai, 2021\n\n"; |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
48 |
print "Usage: $0 [--input input_file] [--pattern pattern_file] [--pattern another] [--top final_macro] \n"; |
10
72f6df1085b7
perlgrok.pl: use shorter (qr//) regexp test
Peter Gervai <grin@grin.hu>
parents:
9
diff
changeset
|
49 |
print " [--parsed parsed_outfile] [--failed failed_lines_file] [--debug n] [--help]\n"; |
72f6df1085b7
perlgrok.pl: use shorter (qr//) regexp test
Peter Gervai <grin@grin.hu>
parents:
9
diff
changeset
|
50 |
print " defaults are stdin, stdout, 'patterns' as patternfile and 'TEST' as final macro.\n\n"; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
51 |
exit; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
52 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
53 |
|
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
54 |
if( $#fn_patterns < 0 ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
55 |
push @fn_patterns, "patterns"; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
56 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
57 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
58 |
|
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
59 |
# read patterns |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
60 |
foreach my $fn_pattern (@fn_patterns) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
61 |
my $f = new IO::File "< $fn_pattern" or die "cannot open pattern $fn_pattern: $!"; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
62 |
&d(7, "Reading $fn_pattern pattern file contents"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
63 |
while( <$f> ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
64 |
chomp; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
65 |
# skip empty and comment lines |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
66 |
next if /^ *(#|$)/; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
67 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
68 |
# parse <name><space><content> |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
69 |
if( /^(\S+) +(.+)$/ ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
70 |
if( defined( $input{$1} ) ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
71 |
&d(1, "Warning: duplicate macro $1 in $fn_pattern; overwrites previous version!"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
72 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
73 |
$input{$1} = $2; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
74 |
} else { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
75 |
die "Patternfile $fn_pattern parse error:\n$_\n\n"; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
76 |
} |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
77 |
} |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
78 |
$f->close; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
79 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
80 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
81 |
&d(5, "Start program"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
82 |
&resolve( $top, '<root>' ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
83 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
84 |
my $res = $input{$top}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
85 |
&d(9, "RESULT\n========\n${top} = $res" ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
86 |
&d(9, "Pattern length=" . length($res) ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
87 |
|
10
72f6df1085b7
perlgrok.pl: use shorter (qr//) regexp test
Peter Gervai <grin@grin.hu>
parents:
9
diff
changeset
|
88 |
## test final pattern |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
89 |
eval { |
10
72f6df1085b7
perlgrok.pl: use shorter (qr//) regexp test
Peter Gervai <grin@grin.hu>
parents:
9
diff
changeset
|
90 |
my $test = qr($res); |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
91 |
}; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
92 |
if( $@ ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
93 |
print "ERR: $@\n\n"; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
94 |
exit; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
95 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
96 |
|
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
97 |
### read file |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
98 |
my $f = new IO::File "< $fn_test" or die "cannot open $fn_test: $!"; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
99 |
my $ff; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
100 |
if( $fn_fail ) { $ff = new IO::File "> $fn_fail" or die "cannot open $fn_fail for writing: $!"; } |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
101 |
my $fout = new IO::File "> $fn_parsed" or die "cannot open output for parsed: $!"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
102 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
103 |
while( <$f> ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
104 |
chomp; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
105 |
&d(5, "LINE:$_"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
106 |
if( /$res/ ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
107 |
# there is a match, print parsed values |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
108 |
print $fout "$_\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
109 |
for my $k ( sort keys %+ ) { |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
110 |
print $fout "\t".&unxlate($k)." => '$+{$k}'\n"; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
111 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
112 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
113 |
if( $fn_fail ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
114 |
print $ff "$_\n" if $fn_fail ; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
115 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
116 |
print "$_\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
117 |
print "\t-no match-\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
118 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
119 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
120 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
121 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
122 |
$fout->close; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
123 |
$f->close; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
124 |
$ff->close if $fn_fail; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
125 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
126 |
exit; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
127 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
128 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
129 |
######################################################################################################### |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
130 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
131 |
# fully resolve a macro line (recursively) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
132 |
sub resolve { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
133 |
my ($key, $caller_key) = @_; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
134 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
135 |
&d( 7, "Called resolve for $key from $caller_key"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
136 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
137 |
# get macro data from %input |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
138 |
my $data = $input{$key}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
139 |
if( $processing{$key} ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
140 |
# already processing this key: looping |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
141 |
die "Resolving loop in $key: already processing for $processing{$key}! Called from $caller_key."; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
142 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
143 |
$processing{$key} = $caller_key; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
144 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
145 |
&d( 7, "Resolve_all_macros loop in $key"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
146 |
# while we have unresolved macros, walk and resolve them all |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
147 |
while( $data =~ /%\{(?<k>[A-Z_0-9]+)(:(?<v>[_\w.\d]+))?\}/ ) { |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
148 |
my $r_key = $+{k}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
149 |
my $r_name = $+{v} || ""; # this is just informational here |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
150 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
151 |
&d(7, "Resolve macro in $key for '$r_key' (name $r_name) in data /$data/" ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
152 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
153 |
# do we know the macro? |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
154 |
if( defined( $input{ $r_key } ) ) { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
155 |
# resolve everything in the macro |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
156 |
&resolve( $r_key, $key ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
157 |
# replace fully resolved macro in $data |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
158 |
&replace_all( \$data, $r_key ); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
159 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
160 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
161 |
die "Unknown macro '$r_key'! Called from $caller_key."; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
162 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
163 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
164 |
|
11
5c38653bd7e7
perlgrok.pl: sanitize labels even if there was no macro replacement (manual capture groups)
Peter Gervai <grin@grin.hu>
parents:
10
diff
changeset
|
165 |
# sanitize macros where no resolve was necessary but manual entries may still screw perl up |
5c38653bd7e7
perlgrok.pl: sanitize labels even if there was no macro replacement (manual capture groups)
Peter Gervai <grin@grin.hu>
parents:
10
diff
changeset
|
166 |
&sanitize_labels( \$data ); |
5c38653bd7e7
perlgrok.pl: sanitize labels even if there was no macro replacement (manual capture groups)
Peter Gervai <grin@grin.hu>
parents:
10
diff
changeset
|
167 |
|
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
168 |
# update macro in %input with fully resolved line |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
169 |
$input{$key} = $data; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
170 |
&d(7, "RESOLVED '$key'! Result=/$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
171 |
|
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
172 |
if( $re_trace ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
173 |
# die if regexp is bad |
10
72f6df1085b7
perlgrok.pl: use shorter (qr//) regexp test
Peter Gervai <grin@grin.hu>
parents:
9
diff
changeset
|
174 |
my $test = qr($data); |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
175 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
176 |
|
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
177 |
# release loop protection for $key |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
178 |
delete $processing{$key}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
179 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
180 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
181 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
182 |
## replace all macros with replacement [macro-free] regexp |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
183 |
sub replace_all { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
184 |
my ($data, $key) = @_; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
185 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
186 |
&d(7, "Replace_all $key in /$$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
187 |
# while we have this macro in $data somewhere, repeat... |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
188 |
while( $$data =~ /\{${key}(:(?<v>[_\w.\d]+))?\}/ ) { |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
189 |
my $mname = $+{v}; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
190 |
my $inner = $input{$key}; # shall be already resolved, may be checked (FIXME) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
191 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
192 |
&d(7, " Found '$key'"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
193 |
|
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
194 |
my $xname = $mname; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
195 |
if( $mname ) { |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
196 |
# if it's not perl compatible, create a translation entry |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
197 |
if( $mname !~ /^[_A-Za-z][_A-Za-z0-9]*\z/ ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
198 |
$xname = &gen_xlate_entry($mname); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
199 |
} |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
200 |
# named macro, create a named capture group |
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
201 |
$$data =~ s/%\{${key}:${mname}\}/(?<${xname}>${inner})/g; |
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
202 |
&d(7, " Replace $key:$mname with named capture group /$inner/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
203 |
} else { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
204 |
# unnamed macro, we just throw it in (trust no1 and parenthesize it) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
205 |
$$data =~ s/%\{${key}\}/(?:${inner})/g; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
206 |
&d(7, " Replace $key with /$inner/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
207 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
208 |
|
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
209 |
&sanitize_labels( $data ); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
210 |
|
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
211 |
&d(9, " Replacement result is /$$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
212 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
213 |
&d(7, "REPLACED ALL '$key' in /$$data/"); |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
214 |
} |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
215 |
|
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
216 |
|
8
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
217 |
sub gen_xlate_entry { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
218 |
my ($mname) = @_; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
219 |
&d(7, "Generate a translation variable name for $mname"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
220 |
my $xname = "xlate_" . int(rand(1_000_000)); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
221 |
my $count = 100_000; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
222 |
while( defined( $xlate{$xname} ) ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
223 |
$xname = "xlate_" . int(rand(1_000_000)); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
224 |
die "Cannot generate unique translation for $mname in a _lot_ of steps" if --$count<=0; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
225 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
226 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
227 |
&d(7, "Generated $xname as the name for $mname"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
228 |
$xlate{$xname} = $mname; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
229 |
return $xname; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
230 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
231 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
232 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
233 |
# find ?<names> which perl incompatible, and xlate them forcibly |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
234 |
sub sanitize_labels { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
235 |
my ($data) = @_; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
236 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
237 |
if( $$data =~ /(?<!\\)\((?!\\)\?<([_A-Za-z][_A-Za-z0-9]*[^>_A-Za-z0-9])/ ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
238 |
&d(7, "Irregular name in $$data, create translation"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
239 |
# we have at least one irregular, get all labels |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
240 |
while( $$data =~ /(?<!\\)\((?!\\)\?<(.+?)>/g ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
241 |
my $label = $1; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
242 |
&d(9, "Got label $label (***BEFORE $` ##<->## $' AFTER***)"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
243 |
if( $label !~ /^[_A-Za-z][_A-Za-z0-9]*\z/ ) { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
244 |
# not perl compatible, translate and replace |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
245 |
my $xname = &gen_xlate_entry($label); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
246 |
$$data =~ s/(?<!\\)\((?!\\)\?<${label}>/(?<${xname}>/g; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
247 |
&d(5, "ForceReplaced label '$label' with '$xname' in /$$data/"); |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
248 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
249 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
250 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
251 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
252 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
253 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
254 |
sub unxlate { |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
255 |
my ($xkey) = @_; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
256 |
return $xlate{$xkey}; |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
257 |
} |
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
258 |
|
31c4ce4d9b73
perlgrok.pl: Fix patternfile; handle perl-incopatible labels
Peter Gervai <grin@grin.hu>
parents:
7
diff
changeset
|
259 |
|
6
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
260 |
# extremely low-key debug subsystem :-) |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
261 |
sub d { |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
262 |
my ($lvl, $s) = @_; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
263 |
return if $lvl > $DEBUG; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
264 |
print scalar(localtime) . " [$$] ($lvl) $s\n"; |
78c000fd2ee7
Add perlgrok.pl: a logstash/grok compatible perl parser
Peter Gervai <grin@grin.hu>
parents:
diff
changeset
|
265 |
} |