Skip to content

Commit

Permalink
value-pairs: key rewriting support
Browse files Browse the repository at this point in the history
This is the implementation of the key rewriting feature, along with a
couple of other enhancements that were required for the functionality.

The first change is that the key() statement now works very
differently: instead of being a wrapper around pair(), it is now a
glob-accepting include statement instead (with keeping the name).

As such, it no longer guarantees that a given key will appear in the
final set, as excludes still have a chance to override it.

key() and exclude() patterns are now matched in order, and the last
one wins. The only way to guarantee a key into a set, in spite of any
exclude() rules, is via pair(). The key-value pairs specified by
pair() are still inserted into the set afterwards.

The key rewriting itself is done via the new rekey() statement, to be
used under the key() statement, along these lines:

value-pairs(
 key(".cee.*"
     rekey(shift(4)
           add-prefix("Events")
           replace("Events.some_field" "a_new_name")
     )
 )
)

Similarly, the same thing can be done with format-json (without the
line breaks):

$(format-json --key .cee.* --rekey --shift 4 --add-prefix Events
              --replace Events.some_field=a_new_name)

The transformations listed under rekey() are applied to each key
matched by the glob specified for the outer key() statement, and the
transformations are applied in the order they're listed in the
configuration.

This patch implements the following translations: shift($AMOUNT),
which simply shifts the key $AMOUNT characters right;
add-prefix($PREFIX) which does as the name suggests; and
replace($PREFIX, $NEW_PREFIX), which replaces a substring at the start
of the key, with another. The replace() transformation does not
support replacing anything other than a prefix.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
  • Loading branch information
bazsi committed Dec 15, 2011
1 parent 0ef1b92 commit ddc7c25
Show file tree
Hide file tree
Showing 10 changed files with 592 additions and 61 deletions.
4 changes: 3 additions & 1 deletion lib/Makefile.am
Expand Up @@ -79,7 +79,8 @@ pkginclude_HEADERS = \
tlscontext.h \
tlstransport.h \
utils.h \
value-pairs.h
value-pairs.h \
vptransform.h

# this is intentionally formatted so conflicts are less likely to arise. one name in every line.
libsyslog_ng_crypto_la_SOURCES = \
Expand Down Expand Up @@ -146,6 +147,7 @@ libsyslog_ng_la_SOURCES = \
timeutils.c \
utils.c \
value-pairs.c \
vptransform.c \
\
cfg-lex.l \
cfg-grammar.y \
Expand Down
34 changes: 27 additions & 7 deletions lib/cfg-grammar.y
Expand Up @@ -285,6 +285,10 @@ extern struct _LogDriver *last_driver;
%token KW_PAIR 10503
%token KW_KEY 10504
%token KW_SCOPE 10505
%token KW_SHIFT 10506
%token KW_REKEY 10507
%token KW_ADD_PREFIX 10508
%token KW_REPLACE 10509

/* END_DECLS */

Expand All @@ -301,6 +305,7 @@ extern struct _LogDriver *last_driver;
#include "logparser.h"
#include "logrewrite.h"
#include "value-pairs.h"
#include "vptransform.h"
#include "filter-expr-parser.h"
#include "rewrite-expr-parser.h"
#include "block-ref-parser.h"
Expand Down Expand Up @@ -331,6 +336,7 @@ GList *last_parser_expr;
FilterExprNode *last_filter_expr;
CfgArgs *last_block_args;
ValuePairs *last_value_pairs;
ValuePairsTransformSet *last_vp_transset;

}

Expand Down Expand Up @@ -881,13 +887,16 @@ vp_options
vp_option
: KW_PAIR '(' string ':' string ')' { value_pairs_add_pair(last_value_pairs, configuration, $3, $5); free($3); free($5); }
| KW_PAIR '(' string string ')' { value_pairs_add_pair(last_value_pairs, configuration, $3, $4); free($3); free($4); }
| KW_KEY '(' string ')' {
gchar *k = g_strconcat("$", $3, NULL);
value_pairs_add_pair(last_value_pairs, configuration, $3, k);
g_free(k);
free($3);
}
| KW_EXCLUDE '(' string ')' { value_pairs_add_exclude_glob(last_value_pairs, $3); free($3); }
| KW_KEY '(' string KW_REKEY '('
{
last_vp_transset = value_pairs_transform_set_new($3);
value_pairs_add_glob_pattern(last_value_pairs, $3, TRUE);
free($3);
}
vp_rekey_options
')' { value_pairs_add_transforms(last_value_pairs, last_vp_transset); } ')'
| KW_KEY '(' string ')' { value_pairs_add_glob_pattern(last_value_pairs, $3, TRUE); free($3); }
| KW_EXCLUDE '(' string ')' { value_pairs_add_glob_pattern(last_value_pairs, $3, FALSE); free($3); }
| KW_SCOPE '(' vp_scope_list ')'
;

Expand All @@ -896,6 +905,17 @@ vp_scope_list
|
;

vp_rekey_options
: vp_rekey_option vp_rekey_options
|
;

vp_rekey_option
: KW_SHIFT '(' LL_NUMBER ')' { value_pairs_transform_set_add_func(last_vp_transset, value_pairs_new_transform_shift($3)); }
| KW_ADD_PREFIX '(' string ')' { value_pairs_transform_set_add_func(last_vp_transset, value_pairs_new_transform_add_prefix($3)); free($3); }
| KW_REPLACE '(' string string ')' { value_pairs_transform_set_add_func(last_vp_transset, value_pairs_new_transform_replace($3, $4)); free($3); free($4); }
;

/* END_RULES */


Expand Down
4 changes: 4 additions & 0 deletions lib/cfg-parser.c
Expand Up @@ -60,6 +60,10 @@ static CfgLexerKeyword main_keywords[] = {
{ "pair", KW_PAIR, 0x0303 },
{ "key", KW_KEY, 0x0303 },
{ "scope", KW_SCOPE, 0x0303 },
{ "rekey", KW_REKEY, 0x0303 },
{ "shift", KW_SHIFT, 0x0303 },
{ "add_prefix", KW_ADD_PREFIX, 0x0303 },
{ "replace", KW_REPLACE, 0x0303 },

/* option items */
{ "flags", KW_FLAGS },
Expand Down

0 comments on commit ddc7c25

Please sign in to comment.