Improve config parsing for log-carver and fix a grok issue

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Change Log
 
+## 2.6.2
+
+23rd March 2021
+
+Log Carver
+
+- Further improvements and fixes to `if`/`else if`/`else` conditional parsing
+- Fix to `grok` action causing events with an empty field name
+- Improved configuration error reporting
+
 ## 2.6.1
 
 23rd March 2021

lc-lib/core/version.go

@@ -17,4 +17,4 @@
 package core
 
 // LogCourierVersion is the library version number
-const LogCourierVersion string = "2.6.1"
+const LogCourierVersion string = "2.6.2"

lc-lib/grok/pattern.go

@@ -90,6 +90,10 @@ func (c *compiledPattern) Apply(message string, callback ApplyCallback) error {
 
 	for idx := 1; idx < len(results); idx++ {
 		name := c.names[idx]
+		if name == "" {
+			// Unnamed, skip
+			continue
+		}
 
 		var value interface{}
 		if typeHint, ok := c.types[name]; ok {

lc-lib/processor/actiongeoip.go

@@ -58,11 +58,11 @@ func newGeoIPAction(p *config.Parser, configPath string, unused map[string]inter
 	}
 	action.lru, err = lru.New(1000)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Failed to initialse GeoIP at %s: %s", configPath, err)
 	}
 	action.reader, err = geoip2.Open(action.Database)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Failed to initialse GeoIP at %s: %s", configPath, err)
 	}
 	return action, nil
 }

lc-lib/processor/ast.go

@@ -53,7 +53,7 @@ type astLogic struct {
 // Init the branch
 func (l *astLogic) Init(p *config.Parser, path string) (err error) {
 	if l.ifProgram, err = ParseExpression(l.IfExpr); err != nil {
-		return fmt.Errorf("Condition failed to parse: [%s] -> %s", l.IfExpr, err)
+		return fmt.Errorf("Condition failed to parse at %s: [%s] -> %s", path, l.IfExpr, err)
 	}
 	return nil
 }
@@ -97,7 +97,7 @@ type logicBranchElseIf struct {
 // Init the branch
 func (l *logicBranchElseIf) Init(p *config.Parser, path string) (err error) {
 	if l.elseIfProgram, err = ParseExpression(l.ElseIfExpr); err != nil {
-		return fmt.Errorf("Condition failed to parse: [%s] -> %s", l.ElseIfExpr, err)
+		return fmt.Errorf("Condition failed to parse at %s: [%s] -> %s", path, l.ElseIfExpr, err)
 	}
 	return nil
 }

lc-lib/processor/config.go

@@ -98,6 +98,7 @@ func (c *Config) Init(p *config.Parser, path string) error {
 			entryToken = astTokenAction
 		}
 
+	StateMachine:
 		switch state {
 		case astStatePipeline:
 			if entryToken == astTokenAction {
@@ -128,6 +129,10 @@ func (c *Config) Init(p *config.Parser, path string) error {
 				return err
 			}
 			state = astStatePipeline
+			if entryToken != astTokenElse {
+				// We didn't use the token, process it now
+				goto StateMachine
+			}
 		}
 	}
 	if state == astStateIf {