filterx: add SDATA helper functions

[OverOrion]

@version: 4.8
@include "scl.conf"

log {

  source { example-msg-generator(num(1)
    template("[Originator@6876 sub=Vimsvc.ha-eventmgr opID=esxui-13c6-6b16 sid=5214bde6 user=root][anotherSDID@32473 iut=4 eventSource=Application eventID=1012]")
  ); };
  parser{sdata-parser();};
  filterx {
    bar = has_sdata();
    foo = is_sdata_from_enterprise("6876");
    # asd = get_sdata();
    vars();
    };
  destination { file("/dev/stdout"); };
};

[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='Vimsvc.ha-eventmgr', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='esxui-13c6-6b16', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='5214bde6', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='root', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='4', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='Application', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] Setting value; name='[email protected]', value='1012', type='string', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] <<<<<< parser rule evaluation result; result='accepted', rule='#anon-parser0', location='/source/install_dir/etc/asd.conf:9:10', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] >>>>>> filterx rule evaluation begin; rule='#anon-filter0', location='/source/install_dir/etc/asd.conf:10:10', msg='0x59da85103170', rcptid='1872'
[2024-08-07T14:57:58.003231] FILTERX ESTEP; expr='/source/install_dir/etc/asd.conf:11:5|        bar = has_sdata()', value='true', truthy='1', type='boolean'
[2024-08-07T14:57:58.003231] FILTERX ESTEP; expr='/source/install_dir/etc/asd.conf:12:5|        foo = is_sdata_from_enterprise("6876")', value='true', truthy='1', type='boolean'

[bazsi]

I'd love to see the new extract functions being used in the implementation, but it's approved from my part.

[jszigetvari]

subscribe .

[alltilla]

Nice feature, thanks! :)