-
Notifications
You must be signed in to change notification settings - Fork 72
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix incorrect logtype encoding by properly escaping variable placeholder characters (fixes #163). #162
Conversation
…; Deduplicate logtype constant escaping method; Replace all instances of variable delimiter with variable placeholder.
Co-authored-by: Lin Zhihao <[email protected]>
…he dictionary entry. Add unittests
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We also need to update the logtype query generation in ffi::search
. That instance is a bit more complicated: If the logtype query contains no wildcards, we don't want to escape the escape characters (double-escape) since the logtype query won't be used in wildcard matches. I guess the most straightforward way to do this would be to do it while searching the logtype for wildcards in the Subquery
constructor.
Co-authored-by: kirkrodrigues <[email protected]>
Reference
#163
Description
When creating the logtype dictionary, the characters of the variable placeholders in the original log events are not properly escaped, which causes #163. This PR fixes this problem by properly escaping these characters and tracking the location of the escaped placeholders for each logtype dictionary entry. It also handles the escape in
ffi
related code.Rules we added in this PR for logtype encoding:
Validation performed