[MINOR] halog: support backslash-escaped quotes
Some syslog servers escape quotes, which make the resulting logs unusable for URL processing since the parser looks for the first field beginning with a quote. It now supports also fields starting with backslash and quote in order to address this. No performance impact was measured.
This commit is contained in:
parent
d3007ffa6f
commit
61a40c7402
|
@ -1127,8 +1127,12 @@ void filter_count_url(const char *accept_field, const char *time_field, struct t
|
|||
* if there's nothing else.
|
||||
*/
|
||||
e = field_start(e, METH_FIELD - TIME_FIELD + 1); // avg 100 ns per line
|
||||
while (*e != '"' && *e)
|
||||
while (*e != '"' && *e) {
|
||||
/* Note: some syslog servers escape quotes ! */
|
||||
if (*e == '\\' && e[1] == '"')
|
||||
break;
|
||||
e = field_start(e, 2);
|
||||
}
|
||||
|
||||
if (unlikely(!*e)) {
|
||||
truncated_line(linenum, line);
|
||||
|
|
Loading…
Reference in New Issue