-
Notifications
You must be signed in to change notification settings - Fork 3
Open
Description
Description
In some cases ln_loadSamples() returns zero (success) even though the loading of the rulebase failed and an error message was logged through liblognorm error logging callback method.
If the broken rulebase is then used for normalization the ln_normalize() method also returns zero (success), but instead of generating a successfully normalized message the method generates json that contains further error details in normalized form.
The error message logged by the callback method must be used to trigger an exception in the java code, preventing the usage of broken rulebase for normalization.
An example rulebase that is missing version=2
line from the beginning, which will trigger the error:
rule=:%[ {"type":"date-rfc3164", "name":"date"},
{"type":"literal", "text:" "},
{"type":"char-to", "name":"host", "extradata":":"},
{"type":"literal", "text:": no longer listening on "},
{"type":"ipv4", "name":"ip"},
{"type":"literal", "text:"#"},
{"type":"number", "name":"port"}
]%
Metadata
Metadata
Assignees
Labels
No labels