Rsyslog: parse property filters and file actions with complex templates

Fixes RHBZ#1083016

NEWS

@@ -29,6 +29,8 @@
     * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
     * Passwd: Refactor lens (Lorenzo Catucci)
     * Redis: Allow empty quoted values (GH issue #115)
+    * Rsyslog: support complex $template lines, property filters and file
+               actions with templates, RHBZ#1083016
     * Shadow: New lens (Lorenzo Catucci)
     * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
                  Allow any kind of quoted values in block

lenses/rsyslog.aug

@@ -23,24 +23,40 @@ module Rsyslog =
 
 autoload xfm
 
-let macro = [ key /$[A-Za-z0-9]+/ . Sep.space . store Rx.neg1 . Util.comment_or_eol ]
+let macro_rx = /[^,# \n\t][^#\n]*[^,# \n\t]|[^,# \n\t]/
+let macro = [ key /$[A-Za-z0-9]+/ . Sep.space . store macro_rx . Util.comment_or_eol ]
 
 (* View: users
    Map :omusrmsg: and a list of users, or a single *
 *)
-let omusrmsg = Util.del_str ":omusrmsg:" . 
+let omusrmsg = Util.del_str ":omusrmsg:" .
                  Syslog.label_opt_list_or "omusrmsg" (store Syslog.word)
                                           Syslog.comma "*"
 
-let action = Syslog.action | omusrmsg
+(* View: file_tmpl
+   File action with a specified template *)
+let file_tmpl = Syslog.file . [ label "template" . Util.del_str ";" . store Rx.word ]
+
+let action = Syslog.action | omusrmsg | file_tmpl
 
 (* View: entry
    An entry contains selectors and an action
 *)
 let entry = [ label "entry" . Syslog.selectors . Syslog.sep_tab .
               [ label "action" . action ] . Util.eol ]
 
-let entries = ( Syslog.empty | Syslog.comment | entry | macro )*
+(* View: prop_filter
+   Parses property-based filters, which start with ":" and the property name *)
+let prop_filter =
+     let sep = Sep.comma . Util.del_ws_spc
+  in let prop_name = [ Util.del_str ":" . label "property" . store Rx.word ]
+  in let prop_oper = [ label "operation" . store /[A-Za-z!-]+/ ]
+  in let prop_val  = [ label "value" . Quote.do_dquote (store /[^\n"]*/) ]
+  in let prop_act  = [ label "action" . action ]
+  in [ label "filter" . prop_name . sep . prop_oper . sep . prop_val .
+       Sep.space . prop_act . Util.eol ]
+
+let entries = ( Syslog.empty | Syslog.comment | entry | macro | prop_filter )*
 
 let lns = entries . ( Syslog.program | Syslog.hostname )*
 

lenses/syslog.aug

@@ -118,7 +118,7 @@ module Syslog =
 	(* Variable: file_r
 	 a file begins with a / and get almost anything else after
 	 *)
-	let file_r     = /\/[^ \t\n]+/
+	let file_r     = /\/[^ \t\n;]+/
 
 	(* Variable: loghost_r
 	 Matches a hostname, that is labels speparated by dots, labels can't

lenses/tests/test_rsyslog.aug

@@ -118,3 +118,25 @@ test Rsyslog.lns get conf =
       { "omusrmsg" = "foo" }
       { "omusrmsg" = "bar" } }
   }
+
+(* Parse complex $template lines, RHBZ#1083016 *)
+test Rsyslog.lns get "$template SpiceTmpl,\"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\\n\"\n" =
+  { "$template" = "SpiceTmpl,\"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\\n\"" }
+
+(* Parse property-based filters, RHBZ#1083016 *)
+test Rsyslog.lns get ":programname, startswith, \"spice-vdagent\" /var/log/spice-vdagent.log;SpiceTmpl\n" =
+  { "filter"
+    { "property" = "programname" }
+    { "operation" = "startswith" }
+    { "value" = "spice-vdagent" }
+    { "action"
+      { "file" = "/var/log/spice-vdagent.log" }
+      { "template" = "SpiceTmpl" } } }
+
+test Rsyslog.lns get ":msg, !contains, \"error\" /var/log/noterror.log\n" =
+  { "filter"
+    { "property" = "msg" }
+    { "operation" = "!contains" }
+    { "value" = "error" }
+    { "action"
+      { "file" = "/var/log/noterror.log" } } }