Allow path parameter to place normalized fields as subtree

2 files changed, 29 insertions, 1 deletions

diff --git a/doc/mmnormalize.html b/doc/mmnormalize.html
index fc6ec6d2..f09d0993 100644
--- a/doc/mmnormalize.html
+++ b/doc/mmnormalize.html
@@ -38,6 +38,11 @@ can be found in the <a href="http://www.liblognorm.com/files/manual/index.html">
 <li><b>useRawMsg</b> [boolean]<br>
 Specifies if the raw message should be used for normalization (on) or just the
 MSG part of the message (off). Default is "off".
+<li><b>path</b> [word], defaults to "$!"<br>
+Specifies the JSON path under which parsed elements should be placed. By default,
+all parsed properties are merged into root of message properties. You can place them
+under a subtree, instead. You can place them in local variables, also, by setting
+path="$.".
 </ul>
 <p><b>Legacy Configuration Directives</b>:</p>
 <ul>
diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c
index e707b289..613f002d 100644
--- a/plugins/mmnormalize/mmnormalize.c
+++ b/plugins/mmnormalize/mmnormalize.c
@@ -63,6 +63,7 @@ typedef struct _instanceData {
 	sbool bUseRawMsg;	/**< use %rawmsg% instead of %msg% */
 	uchar 	*rulebase;	/**< name of rulebase to use */
 	ln_ctx ctxln;		/**< context to be used for liblognorm */
+	char *pszPath;		/**< path of normalized data */
 } instanceData;
 
 typedef struct wrkrInstanceData {
@@ -79,6 +80,7 @@ static configSettings_t cs;
 /* action (instance) parameters */
 static struct cnfparamdescr actpdescr[] = {
 	{ "rulebase", eCmdHdlrGetWord, 1 },
+	{ "path", eCmdHdlrGetWord, 0 },
 	{ "userawmsg", eCmdHdlrBinary, 0 }
 };
 static struct cnfparamblk actpblk =
@@ -172,6 +174,7 @@ BEGINfreeInstance
 CODESTARTfreeInstance
 	free(pData->rulebase);
 	ln_exitCtx(pData->ctxln);
+	free(pData->pszPath);
 ENDfreeInstance
 
 
@@ -219,7 +222,7 @@ CODESTARTdoAction
 	}
 	es_deleteStr(str);
 
- 	msgAddJSON(pMsg, (uchar*)"!", json);
+ 	msgAddJSON(pMsg, (uchar*)pWrkrData->pData->pszPath + 1, json);
 
 ENDdoAction
 
@@ -229,12 +232,14 @@ setInstParamDefaults(instanceData *pData)
 {
 	pData->rulebase = NULL;
 	pData->bUseRawMsg = 0;
+	pData->pszPath = strdup("$!");
 }
 
 BEGINnewActInst
 	struct cnfparamvals *pvals;
 	int i;
 	int bDestructPValsOnExit;
+	char *cstr;
 CODESTARTnewActInst
 	DBGPRINTF("newActInst (mmnormalize)\n");
 
@@ -262,6 +267,23 @@ CODESTARTnewActInst
 			pData->rulebase = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
 		} else if(!strcmp(actpblk.descr[i].name, "userawmsg")) {
 			pData->bUseRawMsg = (int) pvals[i].val.d.n;
+		} else if(!strcmp(actpblk.descr[i].name, "path")) {
+			cstr = es_str2cstr(pvals[i].val.d.estr, NULL);
+			if (strlen(cstr) < 2) {
+				errmsg.LogError(0, RS_RET_VALUE_NOT_SUPPORTED,
+						"mmnormalize: valid path name should be at least "
+						"2 symbols long, got %s",	cstr);
+				free(cstr);
+			} else if (cstr[0] != '$') {
+				errmsg.LogError(0, RS_RET_VALUE_NOT_SUPPORTED,
+						"mmnormalize: valid path name should start with $,"
+						"got %s", cstr);
+				free(cstr);
+			} else {
+				free(pData->pszPath);
+				pData->pszPath = cstr;
+			}
+			continue;
 		} else {
 			DBGPRINTF("mmnormalize: program error, non-handled "
 			  "param '%s'\n", actpblk.descr[i].name);
@@ -297,6 +319,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1)
 
 	pData->rulebase = cs.rulebase;
 	pData->bUseRawMsg = cs.bUseRawMsg;
+	pData->pszPath = strdup("$!"); /* old interface does not support this feature */
 	/* all config vars auto-reset! */
 	cs.bUseRawMsg = 0;
 	cs.rulebase = NULL; /* we used it up! */