private void ParseStructuredData(ParserContext ctx) { ctx.SkipSpaces(); if (ctx.Current == SyslogChars.NilChar) { ctx.Position++; return; } var data = ctx.Entry.StructuredData; try { if (ctx.Current != SyslogChars.Lbr) { // do not report it as an error, some messages out there are a bit malformed // ctx.AddError("Expected [ for structured data."); return; } // start parsing elements while (!ctx.Eof()) { var elem = ParseElement(ctx); if (elem == null) { return; } data[elem.Item1] = elem.Item2; } } catch (Exception ex) { ctx.AddError(ex.Message); } }
public static void SkipSpaces(this ParserContext ctx) { while (!ctx.Eof() && ctx.Current == SyslogChars.Space) { ctx.Position++; } }
} //method private List <NameValuePair> ReadKeyValuePairs(ParserContext ctx) { var prmList = new List <NameValuePair>(); NameValuePair lastPrm = null; /* * 2 troubles here: */ while (!ctx.Eof()) { ctx.SkipSpaces(); var name = ctx.ReadWord(); if (!ctx.ReadSymbol('=', throwIfMismatch: false)) { // Some entries are malformed: double quoted strings // the result is that we do not find '=' after closing the quote. So we just add the rest to a separate param and exit var text = ctx.Text.Substring(ctx.Position); prmList.Add(new NameValuePair() { Name = "Message", Value = text }); return(prmList); } ctx.SkipSpaces(); string value; if (ctx.Current == SyslogChars.DQuote) { // For double-quoted values, some values are malformed - they contain nested d-quoted strings that are not escaped. value = ctx.ReadQuotedString(); } else { // Special case: non quoted empty values, ex: ' a= b=234 '; value of 'a' is Empty. We check the char after we read the value, // and if it is '=', we back off, set value to empty. var saveP = ctx.Position; value = ctx.ReadWord(); if (ctx.Current == '=') { ctx.Position = saveP; value = string.Empty; } } lastPrm = new NameValuePair() { Name = name, Value = value }; prmList.Add(lastPrm); } return(prmList); }
private string ParseMessage(ParserContext ctx) { if (ctx.Eof()) { return(null); } var msg = ctx.Text.Substring(ctx.Position); msg = msg.TrimStart(SyslogChars.Space); // RFC 5424 allows BOM (byte order mark, 3 byte sequence) to precede the actual message. // it will be read into the message OK, now 'msg' can contain this prefix - it is invisible // and will bring a lot of trouble when working with the string (ex: string comparisons are broken) // So we remove it explicitly. return(msg.CutOffBOM()); }