The version 2 quoted-string parser is incorrectly including the surrounding quotes in the extracted value, unlike version 1.
Sample log
$ cat quotedstring.log
"value1" "value2"
"value1" value2
Version 1 ruleset
$ cat quotedstring.v1.rb
rule=:%field1:quoted-string% %field2:op-quoted-string%
Version 1 works as expected
$ cat quotedstring.log | lognormalizer -e json -r quotedstring.v1.rb | jq --sort-keys .
{
"field1": "value1",
"field2": "value2"
}
{
"field1": "value1",
"field2": "value2"
}Version 2 ruleset
$ cat quotedstring.v2.rb
version=2
rule=:%field1:quoted-string% %field2:op-quoted-string%
Version 2 has unexpected result
$ cat quotedstring.log | lognormalizer -e json -r quotedstring.v2.rb | jq --sort-keys .
{
"field1": "\"value1\"",
"field2": "value2"
}
{
"field1": "\"value1\"",
"field2": "value2"
}
The version 2 quoted-string parser is incorrectly including the surrounding quotes in the extracted value, unlike version 1.
Sample log
Version 1 ruleset
Version 1 works as expected
Version 2 ruleset
Version 2 has unexpected result