private Tuple <string, List <NameValuePair> > ParseElement(ParserContext ctx)
{
if (ctx.Current != SyslogChars.Lbr)
{
return(null);
}
ctx.Position++;
var elemName = ctx.ReadWord();
ctx.SkipSpaces();
var paramList = new List <NameValuePair>();
var elem = new Tuple <string, List <NameValuePair> >(elemName, paramList);
while (ctx.Current != SyslogChars.Rbr)
{
var paramName = ctx.ReadWord();
ctx.ReadSymbol('=');
var paramValue = ctx.ReadQuotedString();
var prm = new NameValuePair()
{
Name = paramName, Value = paramValue
};
paramList.Add(prm);
ctx.SkipSpaces();
}
ctx.ReadSymbol(SyslogChars.Rbr);
return(elem);
}
} //method
private List <NameValuePair> ReadKeyValuePairs(ParserContext ctx)
{
var prmList = new List <NameValuePair>();
NameValuePair lastPrm = null;
/*
* 2 troubles here:
*/
while (!ctx.Eof())
{
ctx.SkipSpaces();
var name = ctx.ReadWord();
if (!ctx.ReadSymbol('=', throwIfMismatch: false))
{
// Some entries are malformed: double quoted strings
// the result is that we do not find '=' after closing the quote. So we just add the rest to a separate param and exit
var text = ctx.Text.Substring(ctx.Position);
prmList.Add(new NameValuePair()
{
Name = "Message", Value = text
});
return(prmList);
}
ctx.SkipSpaces();
string value;
if (ctx.Current == SyslogChars.DQuote)
{
// For double-quoted values, some values are malformed - they contain nested d-quoted strings that are not escaped.
value = ctx.ReadQuotedString();
}
else
{
// Special case: non quoted empty values, ex: ' a= b=234 '; value of 'a' is Empty. We check the char after we read the value,
// and if it is '=', we back off, set value to empty.
var saveP = ctx.Position;
value = ctx.ReadWord();
if (ctx.Current == '=')
{
ctx.Position = saveP;
value = string.Empty;
}
}
lastPrm = new NameValuePair()
{
Name = name, Value = value
};
prmList.Add(lastPrm);
}
return(prmList);
}
// let try to match any key, like <120> abc = def
private bool TryMatchAnyKey(ParserContext ctx)
{
if (!char.IsLetter(ctx.Current))
{
return(false);
}
var savePos = ctx.Position;
var word = ctx.ReadWord();
ctx.SkipSpaces();
var result = ctx.Match("=");
ctx.Position = savePos;
return(result);
}
public static DateTime?ParseStandardTimestamp(this ParserContext ctx)
{
var ts = ctx.ReadWord();
if (ts == null)
{
return(null);
}
if (DateTime.TryParse(ts, out var dt))
{
// by default TryParse produces local time
return(dt.ToUniversalTime());
}
ctx.AddError($"Invalid timestamp '{ts}'.");
return(DateTime.MinValue);
}
public static string ReadWordOrNil(this ParserContext ctx)
{
var word = ctx.ReadWord();
return((word == SyslogChars.Nil) ? null : word);
}
