From f09010e15e4d824ebeef1e092340c283826a3887 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Thu, 21 Nov 2013 14:27:16 +0100
Subject: bugfix: mmpstrucdata generated inaccessible properties

---
 ChangeLog                           |  1 +
 doc/mmpstrucdata.html               | 23 +++++++++++++++++++++++
 plugins/mmpstrucdata/mmpstrucdata.c |  6 ++++--
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 0ed1622a..7e0d0052 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@ Version 7.5.7 [v7-devel] 2013-11-??
   * queue.workerThreadMinimumMessage set to queue.size / num workers
   For queues with very low queue.maxSize (< 100), "emergency" defaults
   will be used.
+- bugfix: mmpstrucdata generated inaccessible properties
 - bugfix: RainerScript optimizer did not optimize PRI filters
   things like "if $syslogfacility-text == "local3"" were not converted
   to PRIFILT. This was a regression introduced in 7.5.6.
diff --git a/doc/mmpstrucdata.html b/doc/mmpstrucdata.html
index b4003062..8197d94a 100644
--- a/doc/mmpstrucdata.html
+++ b/doc/mmpstrucdata.html
@@ -13,6 +13,7 @@
 <p><b>Description</b>:</p>
 <p>The mmpstrucdata parses RFC5424 structured data into the message
 json variable tree.
+The data parsed, if available, is stored under "jsonRoot!rfc5424-sd!...".
 <p>&nbsp;</p>
 
 <p><b>Module Configuration Parameters</b>:</p>
@@ -33,6 +34,10 @@ Specifies into which json container the data shall be parsed to.
 <p><b>Caveats/Known Bugs:</b>
 <ul>
 <li>this module is currently experimental; feedback is appreciated
+<li>property names are treated case-insensitive in rsyslog. As such,
+RFC5424 names are treated case-insensitive as well. If such names
+only differ in case (what is not recommended anyways), problems will
+occur.
 <li>structured data with duplicate SD-IDs and SD-PARAMS is not
     properly processed
 </ul>
@@ -48,6 +53,24 @@ template(name="jsondump" type="string" string="%msg%: %$!%\n")
 action(type="omfile" file="/path/to/log" template="jsondump")
 </textarea>
 
+<p><b>A more practical one:</b>
+<p>Take this example message (inspired by RFC5424 sample;)):
+<p><code><34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][id@2 test="tast"] BOM'su root' failed for lonvick on /dev/pts/8</code>
+<p>We apply this configuration:
+<p><textarea rows="6" cols="120">module(load="mmpstrucdata")
+action(type="mmpstrucdata")
+template(name="sample2" type="string"
+         string="ALL: %$!%\nSD: %$!RFC5424-SD%\nIUT:%$!rfc5424-sd!exampleSDID@32473!iut%\nRAWMSG: %rawmsg%\n\n")
+action(type="omfile" file="/path/to/log" template="sample2")
+</textarea>
+<p>This will output:
+<p><code>ALL: { "rfc5424-sd": { "examplesdid@32473": { "iut": "3", "eventsource": "Application", "eventid": "1011" }, "id@2": { "test": "tast" } } }</br>
+SD: { "examplesdid@32473": { "iut": "3", "eventsource": "Application", "eventid": "1011" }, "id@2": { "test": "tast" } }</br>
+IUT:3</br>
+RAWMSG: <34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][id@2 test="tast"] BOM'su root' failed for lonvick on /dev/pts/8</code>
+<p>As you can seem, you can address each of the individual items. Note that the
+case of the RFC5424 parameter names has been converted to lower case.
+
 <p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] [<a href="manual.html">manual 
 index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
 <p><font size="2">This documentation is part of the
diff --git a/plugins/mmpstrucdata/mmpstrucdata.c b/plugins/mmpstrucdata/mmpstrucdata.c
index 4b2a985b..123363bc 100644
--- a/plugins/mmpstrucdata/mmpstrucdata.c
+++ b/plugins/mmpstrucdata/mmpstrucdata.c
@@ -31,6 +31,7 @@
 #include <errno.h>
 #include <unistd.h>
 #include <stdint.h>
+#include <ctype.h>
 #include "conf.h"
 #include "syslogd-types.h"
 #include "srUtils.h"
@@ -206,7 +207,8 @@ dbgprintf("DDDD: parseSD_NAME %s\n", sdbuf+*curridx);
 		if(   sdbuf[i] == '=' || sdbuf[i] == '"'
 		   || sdbuf[i] == ']' || sdbuf[i] == ' ')
 			break;
-		namebuf[j] = sdbuf[i++];
+		namebuf[j] = tolower(sdbuf[i]);
+		++i;
 	}
 	namebuf[j] = '\0';
 dbgprintf("DDDD: parseSD_NAME, NAME: '%s'\n", namebuf);
@@ -337,7 +339,7 @@ dbgprintf("DDDD: json: '%s'\n", json_object_get_string(json));
 	if(jroot == NULL) {
 		ABORT_FINALIZE(RS_RET_ERR);
 	}
-	json_object_object_add(jroot, "RFC5424-SD", json);
+	json_object_object_add(jroot, "rfc5424-sd", json);
  	msgAddJSON(pMsg, pData->jsonRoot, jroot);
 finalize_it:
 	RETiRet;
-- 
cgit v1.2.3