private void ParseStructuredData(ParserContext ctx)
{
ctx.SkipSpaces();
if (ctx.Current == SyslogChars.NilChar)
{
ctx.Position++;
return;
}
var data = ctx.Entry.StructuredData;
try
{
if (ctx.Current != SyslogChars.Lbr)
{
// do not report it as an error, some messages out there are a bit malformed
// ctx.AddError("Expected [ for structured data.");
return;
}
// start parsing elements
while (!ctx.Eof())
{
var elem = ParseElement(ctx);
if (elem == null)
{
return;
}
data[elem.Item1] = elem.Item2;
}
} catch (Exception ex)
{
ctx.AddError(ex.Message);
}
}
public static void SkipSpaces(this ParserContext ctx)
{
while (!ctx.Eof() && ctx.Current == SyslogChars.Space)
{
ctx.Position++;
}
}
} //method
private List <NameValuePair> ReadKeyValuePairs(ParserContext ctx)
{
var prmList = new List <NameValuePair>();
NameValuePair lastPrm = null;
/*
* 2 troubles here:
*/
while (!ctx.Eof())
{
ctx.SkipSpaces();
var name = ctx.ReadWord();
if (!ctx.ReadSymbol('=', throwIfMismatch: false))
{
// Some entries are malformed: double quoted strings
// the result is that we do not find '=' after closing the quote. So we just add the rest to a separate param and exit
var text = ctx.Text.Substring(ctx.Position);
prmList.Add(new NameValuePair()
{
Name = "Message", Value = text
});
return(prmList);
}
ctx.SkipSpaces();
string value;
if (ctx.Current == SyslogChars.DQuote)
{
// For double-quoted values, some values are malformed - they contain nested d-quoted strings that are not escaped.
value = ctx.ReadQuotedString();
}
else
{
// Special case: non quoted empty values, ex: ' a= b=234 '; value of 'a' is Empty. We check the char after we read the value,
// and if it is '=', we back off, set value to empty.
var saveP = ctx.Position;
value = ctx.ReadWord();
if (ctx.Current == '=')
{
ctx.Position = saveP;
value = string.Empty;
}
}
lastPrm = new NameValuePair()
{
Name = name, Value = value
};
prmList.Add(lastPrm);
}
return(prmList);
}
private string ParseMessage(ParserContext ctx)
{
if (ctx.Eof())
{
return(null);
}
var msg = ctx.Text.Substring(ctx.Position);
msg = msg.TrimStart(SyslogChars.Space);
// RFC 5424 allows BOM (byte order mark, 3 byte sequence) to precede the actual message.
// it will be read into the message OK, now 'msg' can contain this prefix - it is invisible
// and will bring a lot of trouble when working with the string (ex: string comparisons are broken)
// So we remove it explicitly.
return(msg.CutOffBOM());
}
