Skip to content

Commit

Permalink
Sdata parser (#15)
Browse files Browse the repository at this point in the history
* Typo fix

* [4.1] Adds minimal sdata-parser docs

* Minor fixes
  • Loading branch information
eldarnash authored Aug 8, 2023
1 parent f0a8108 commit 923fd40
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 2 deletions.
2 changes: 1 addition & 1 deletion content/chapter-parsers/date-parser/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Note that parsing will fail if the format string does not match the entire templ
parser parser_name {
date-parser(
format("<format-string-for-the-date>")
template("<field-to-parse>'")
template("<field-to-parse>")
);
};
```
Expand Down
24 changes: 24 additions & 0 deletions content/chapter-parsers/sdata-parser/_index.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
---
title: "Structured data (SDATA) parser"
weight: 1850
---
<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->

Available in {{% param "product.abbrev" %}} 4.1 and later.

The `sdata-parser()` allows you to parse an RFC5424-style structured data string. You can use it to parse this relatively complex format separately, for example, to process malformatted messages. You can use the optional `prefix` option to add a specific string before the names of the parsed name-value pairs.

## Declaration

```shell
parser parser_name {
sdata-parser(
template("<string-or-template-to-parse>")
prefix("<prefix-for-parsed-name-value-pairs>")
);
};
```

{{% include-headless "chunk/option-parser-prefix.md" %}}

{{% include-headless "chunk/option-parser-template.md" %}}
2 changes: 1 addition & 1 deletion content/headless/chunk/option-parser-template.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@

| | |
| --------- | ---------------------------- |
| Synopsis: | template("${<macroname>}") |
| Synopsis: | `template("${<macroname>}")` |

*Description:* The macro that contains the part of the message that the parser will process. It can also be a macro created by a previous parser of the log path. By default, the parser processes the entire message (`${MESSAGE}`).

0 comments on commit 923fd40

Please sign in to comment.