mtail icon indicating copy to clipboard operation
mtail copied to clipboard

Add a way to test if a capture group has been defined in current scope

Open finkr opened this issue 6 years ago • 6 comments

Hi

When using a syntax like ((?P<response_size>\d+)|-) on a line containing a - instead of a digit, the variable response_time is undefined. When attempting to use that variable, mtail throws an error.

This error can be reproduced using apache_common.mtail and testdata/apache-common.log

...or this simplified test

Program

counter total

/^[a-z]+ ((?P<response_size>\d+)|-)$/ {

    $response_size > 0 {
            total = $response_size
    }
}

input log

test 99
test -

mtail output log

vm.go:92] test.mtail: Runtime error: strconv.ParseInt: parsing "": invalid syntax
vm.go:93] Error occurred at instruction 5 {s2i, <nil>}, originating in test.mtail at line 5
vm.go:95] Full input text from "log" was "test -"

I'am using mtail v3.0.0-rc33 (I tested rc16 and rc25 which have a similar behaviur)

finkr avatar Sep 04 '19 21:09 finkr

I struggle to use that variable... all my attempts fails (I tried to use len(), or string()... but all fails.

As a workaround, I had to use an extra regex instead of checking the variable value

counter total

/^[a-z]+ ((?P<response_size>\d+)|-)$/ {

    # check if the current line contains a digit (not a dash)
    / \d+$/ {
            total = $response_size
    }
}

finkr avatar Sep 04 '19 21:09 finkr

It didn't match so the value is empty. Put the variable definition outside the | condition, and it will be either a number or a -.

In this case the capture group should be comparable to "" to know if it matched.

On Thu, 5 Sep 2019, 07:36 Frank lin Piat, [email protected] wrote:

I struggle to use that variable... all my attempts fails (I tried to use len(), or string()... but all fails.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/google/mtail/issues/267?email_source=notifications&email_token=AAXFX66BSNCMSVB44PV3XDDQIAS7RA5CNFSM4ITWPSFKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD55CANI#issuecomment-528097333, or mute the thread https://github.com/notifications/unsubscribe-auth/AAXFX644CI3LGW7Y754T7ALQIAS7RANCNFSM4ITWPSFA .

jaqx0r avatar Sep 05 '19 09:09 jaqx0r

In this particular case it would work... But there are some other case where it is not possible.

We need to be able to test a variable no matter if it match or not.

finkr avatar Sep 05 '19 10:09 finkr

The answer you came up with in https://github.com/google/mtail/issues/267#issuecomment-528097333 is the correct way to do this.

You've matched a field which is either a number or not a number. mtail can't parse the hyphen as a number, so it's up to you to tell it how to act. The inner condition will do the right thing at that point.

jaqx0r avatar Jan 13 '21 00:01 jaqx0r

I can add this pattern to the documentation, possibly even make the error easier to understand; is there anything else you think mtail should do here?

jaqx0r avatar Jan 13 '21 00:01 jaqx0r

OK I think the feature to add is that we need a way to test if a capture group is defined.

The current programme that works is to test the surrounding capture group content, but I admit tis does not make the pgramme very readable.

jaqx0r avatar Jan 13 '21 01:01 jaqx0r