I'm trying to understand the underlying logic of the Fields parameters within
xm_csv, as I have a situation where the number of parameters may not be
definitely known.
After getting some errors (discussed below), I ended up codifying an xm_csv
definition like this one:
Fields $p1, $p2, $p3, $p4, $p5, $p6, $p7, $p8, $p9, $p10,
$p11, \
$p12, $p13, $p14, $p15, $p16, $p17, $p18, $p19,
$p20, $p21, $p22, $p23
However, when I first started I had coded the fields like this, with some
padded (extra) fields, because it seemed to fail if there weren't enough fields
available:
Fields $p1, $p2, $p3, $p4, $p5, $p6, $p7, $p8, $p9, $p10,
$p11, \
$p12, $p13, $p14, $p15, $p16, $p17, $p18, $p19,
$p20, $p21, $p22, $p23, \
$a1, $a2, $a3, $a4, $a5, $a6, $a7, $a8, $a9,
$a10
However, the definition above (with 33 available fields) failed, with an error
that (edited) says:
"Not enough fields in CSV input, expected 33, got 22 in input".
So here's what I'm not understanding, why does parse_csv allow 23 Fields to be
specified, with only 22 input values, but then fails when there are 24 (or 33)
Fields defined? I'm trying to deal with IIS input where there may be a default
configuration (with 14 params), or the full set of 22 params. But if I define
22 (or 23), and only get 14, then it appears that the whole thing will fail.
And, because it's part of an if-else expression, it basically "jumps out" of
that entire expression, and then none of the parsed information gets properly
built in the $raw_event field (because those activities are nested in my "else"
leg).
I can see why it might generate an error if it doesn't have enough fields, but
I don't understand why an "excess of one Field" is OK, but any further excess
Fields causes a complete failure? I just figure that I must be missing
something. Possibly some "ignore mismatch" directive, that would prevent the
failure situation? Any guidance would be appreciated.
(And, I guess I would have even expected "too few" parameters to not result in
a complete failure. I would have simply expected that it would have "stop
parsing data", because if you got an occasional "garbage line", with two much
data, which might be the case with some applications, this failure scenario
would also cause a complex if-else structure to fail completely, most likely
resulting in the loss of a lot of formatting activity.)
Sorry for my confusion! Thanks for your help.
Marvin Nipper
The information transmitted, including any content in this communication is
confidential, is intended only for the use of the intended recipient and is the
property of The Western Union Company or its affiliates and subsidiaries. If
you are not the intended recipient, you are hereby notified that any use of the
information contained in or transmitted with the communication or
dissemination, distribution, or copying of this communication is strictly
prohibited. If you have received this communication in error, please notify the
Western Union sender immediately by replying to this message and delete the
original message
------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:
Build for Windows Store.
http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
nxlog-ce-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
