templates that don't match the pattern

[gfa]

Hello

I'm migrating from logcheck to erpel and it is going well so far, thanks for this wonderful software :)

Writing rules I found that there is something that could be improved IMHO. The fact that the templates needs to match the pattern makes the rules harder to read and sometimes collides with actual ogs

Removing that restriction rules are easier to write and they are more clear for the reader (I hope), for example comparing the dovecot rules vs some of the rules I wrote

field msgid {
    template = '20160602211704.9125E5A063@localhost'
    pattern = '[a-zA-Z0-9_+.-]+@[a-zA-Z0-9_+.-]+'
}

field MsgID {
    template = 'MsgID'
    pattern = '[a-zA-Z0-9_+.@\/-]+' # pattern changed to match both dovecot and postfix msg id
}

It is a lot easier to write and understand MsgID than 20160602211704.9125E5A063@localhost

field num {
    template = '123'
    pattern = '\d+'
}

field Number {
    template = 'Number'
    pattern = '\d+'
}

123 matched an actual log line from one of my services.

I have chosen a pseudo camel case to name the templates with hopes it will never collide with log entries

here is an example of a descriptive template I'm using

field SyncthingDeviceID {
    template = 'SyncthingDeviceID'
    pattern = '([[:alnum:]]{7}-){7}[[:alnum:]]{7}'
    samples = [ 'BALQ6NF-5AEECEH-5ZW6VGZ-WYF4R32-7GELYNL-F2OMEYS-5WE4FNK-YWN5EQ2']
}

here is a patch to accomplish this, which could be surely improved as my knowledge of go is pretty poor

diff --git a/internal/erpel/rule.go b/internal/erpel/rule.go
index 7d3a4fb3d357..ffdc99aa9ab0 100644
--- a/internal/erpel/rule.go
+++ b/internal/erpel/rule.go
@@ -165,13 +165,8 @@ func checkPattern(r *regexp.Regexp, s string) error {
        return nil
 }

-// Check returns an error if the field's pattern does not match the template or
-// the samples.
+// Check returns an error if the field's pattern does not match the samples
 func (f *Field) Check() error {
-       if err := checkPattern(f.Pattern, f.Template); err != nil {
-               return errors.WithStack(err)
-       }
-
        for _, sample := range f.Samples {
                if err := checkPattern(f.Pattern, sample); err != nil {
                        return errors.WithStack(err)

[fd0]

Oh wow, I didn't know somebody else uses erpel. Since I don't use it (any more), please feel free to submit a PR which adds the patch and lifts the restriction.

I've just pushed a commit which cleans up some very old things.

I'm not sure what to do with erpel, I don't use it any more and I don't have the time to maintain it. Archive the repo?

[gfa]

Oh wow, I didn't know somebody else uses erpel.

I tried it out of frustration with logcheck and I have to say it is a lot better

I've just pushed a commit which cleans up some very old things.

I'm not sure what to do with erpel, I don't use it any more and I don't have the time to maintain it. Archive the repo?

It is a bit sad if you archive it but I totally understand it, I don't know go to maintain it myself.

thanks again for erpel!

[fd0]

I've commited your patch and archived this repo. Thanks again!