Disable automatic whitespace trimming?

Graylog Central (peer support)
1

Hello Graylog community,
anyone knows if Ignoring leading Whitespace? applies to fields created by pipeline processor?

Because I think it is. This is annoying, because I wanted to write a pipeline like this:

let matched = regex("^Prefix keyA=([a-zA-Z]+)( [a-z=A-Z ]+)?$", to_string($message.message),
                   [                "val1",  "other_vals"]);
set_field("fieldA", matched["val1"]);
set_field("stash", matched["other_vals"]);

And leave breaking down that variable-length arguments for another step:

let matched = regex("^(?: optkeyB=([a-zA-Z]+))?(?: optkeyC=([a-zA-Z]+))?(?: optkeyD=([a-zA-Z]+))?$", to_string($message.stash),
                   [                "val2",                  "val3",                  "val4"   ]);
set_field("fieldB", matched["val2"]);
set_field("fieldC", matched["val3"]);
set_field("fieldD", matched["val4"]);
remove_field("stash");

but it never works, as if other_vals never started with space.

Anyone knows what motivated graylog devs to begin silently altering my data?
Is there a way to save a value as-is?

2

Hello @nisow95612

I did find a couple of post/s that might help.

As for “Disable automatic whitespace trimming”. None that I personally know of, but some else here might have done that.

2 Likes
3

I think your regex for other_vals is off. If you are expecting it to match something like “optval2=aaa” then your pattern needs to include numbers and “=”. Currently you are only matching letters and space.

I was successfully able to make that work. And other_vals did include a leading space.
However, set_field does indeed trim white space.

1 Like
4

Oh, right. Thank you @patrickmann. I edited the example to fix these. See any more errors?

Yes, it all works when I put it into a single pipeline rule. I wanted to split it in multiple rules because there more ways this other_vals can look.

So far I have only ugly ideas:

  • Match space or beginning in regex: regex("^(?:(?:^| )optkeyB=([a-zA-Z]+))?(?:(?:^| )optkeyC=([a-zA-Z]+))?(?:(?:^| )optkeyD=([a-zA-Z]+))?$", to_string($message.stash), but I find that mess of characters hard to read.
  • Re-add that space regex("^(?: optkeyB=([a-zA-Z]+))?(?: optkeyC=([a-zA-Z]+))?(?: optkeyD=([a-zA-Z]+))?$", concat(" ", to_string($message.stash)), but that feels dirty
  • Protect that space by prepending some “guard” or replacing - idea by @gsmith’s links, but that match group is optional. I don’t know how to prepend a character if it is string, but keep it null if it is null.
5

Just for future reference, here is where the value gets trimmed when adding a field to a message.
Currently there is no way to prevent that from happening.

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.