cwadhwani-splunk
commented
3 days ago @imsidr
I can see there is a typo in your parser definition. The definition should be block parser app-dest-cisco_acs-postfilter instead of block parser app-dest-ciso_acs-postfilter. Please refer to the below parser:
block parser app-dest-cisco_acs-postfilter() {
channel {
rewrite {
r_set_splunk_dest_default(
index("cisco")
sourcetype('cisco:acs')
vendor("cisco")
product("acs")
);
};
};
};
application app-dest-cisco_acs-postfilter[sc4s-postfilter] {
filter {
host("hsradus" type(glob) flags(ignore-case));
};
parser { app-dest-cisco_acs-postfilter(); };
};Please give this a try and let us know if you are still facing any issues.
imsidr
rjha-splunk
Was the issue replicated by support?
What is the sc4s version ? 3.19.0
Which operating system (including its version) are you using for hosting SC4S? docker container
Which runtime (Docker, Podman, Docker Swarm, BYOE, MicroK8s) are you using for SC4S? docker
Is there a pcap available? If so, would you prefer to attach it to this issue or send it to Splunk support?
Is the issue related to the environment of the customer or Software related issue? Not Sure
Is it related to Data loss, please explain ? Protocol? Hardware specs?
Last chance index/Fallback index? sc4s index
Is the issue related to local customization? Not sure
Do we have all the default indexes created? NA
Describe the bug A clear and concise description of what the bug is. docker container in restarting(1) status Error parsing parser expression, syntax error, unexpected LL_IDENTIFIER, expecting '}' in parser generator app-parser:274:18-274:47: To Reproduce Steps to reproduce the behavior:
I created a filter to parse data based on host and change the index & sourcetype name for cisco acs
/opt/sc4s/local/config/app-parsers/app-dest-cisco_acs.conf
File name provided is a suggestion it must be globally unique
block parser app-dest-ciso_acs-postfilter() { channel { rewrite { r_set_splunk_dest_default( index("cisco") sourcetype('cisco:acs') vendor("cisco") product("acs") ); }; }; }; application app-dest-cisco_acs-postfilter[sc4s-postfilter] { filter { host("hsradus" type(glob) flags(ignore-case)) }; parser { app-dest-cisco_acs-postfilter(); }; };
Getting below error - Error parsing parser expression, syntax error, unexpected LL_IDENTIFIER, expecting '}' in parser generator app-parser:274:18-274:47: 269 270 host("hsradus" type(glob) flags(ignore-case)) 271 272 }; 273 parser { 274---> app-dest-cisco_acs-postfilter(); 274---> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 275 }; 276 rewrite { 277 set-tag('.app.app-dest-cisco_acs-postfilter'); 278 set('app-dest-cisco_acs-postfilter' value('.app.name')); 279 };
Included from /etc/syslog-ng/conf.d/plugin/app_parser_topics.conf:32:5-32:39: 27 parser app-plugin-syslog-fix-program{ 28 app-parser(topic(fix-invalid-program)); 29 }; 30 31 parser app-plugin-source-postprocess{ 32----> app-parser(topic(sc4s-postfilter)); 32----> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 33 }; 34 35 parser app-plugin-source-finalprocess{ 36 app-parser(topic(sc4s-finalfilter)); 37 };
Included from /etc/syslog-ng/syslog-ng.conf:42:1-42:1: 37 38 @include "conf.d/enrich/.conf" 39 @include "conf.d/enrich//.conf" 40 41 @include "conf.d/plugin/.conf" 42----> 42----> ^ 43 @include "conf.d/sources/.conf" 44 @include "conf.d/sources//.conf" 45 @include "conf.d/local/config/sources/.conf" 46 @include "conf.d/local/config/sources//.conf" 47
Error parsing parser expression, syntax error, unexpected LL_IDENTIFIER, expecting '}' in parser generator app-parser:274:18-274:47: 269 270 host("hsradus" type(glob) flags(ignore-case)) 271 272 }; 273 parser { 274---> app-dest-cisco_acs-postfilter(); 274---> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 275 }; 276 rewrite { 277 set-tag('.app.app-dest-cisco_acs-postfilter'); 278 set('app-dest-cisco_acs-postfilter' value('.app.name')); 279 };
Included from /etc/syslog-ng/conf.d/plugin/app_parser_topics.conf:32:5-32:39: 27 parser app-plugin-syslog-fix-program{ 28 app-parser(topic(fix-invalid-program)); 29 }; 30 31 parser app-plugin-source-postprocess{ 32----> app-parser(topic(sc4s-postfilter)); 32----> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 33 }; 34 35 parser app-plugin-source-finalprocess{ 36 app-parser(topic(sc4s-finalfilter)); 37 };
Included from /etc/syslog-ng/syslog-ng.conf:42:1-42:1: 37 38 @include "conf.d/enrich/.conf" 39 @include "conf.d/enrich//.conf" 40 41 @include "conf.d/plugin/.conf" 42----> 42----> ^ 43 @include "conf.d/sources/.conf" 44 @include "conf.d/sources//.conf" 45 @include "conf.d/local/config/sources/.conf" 46 @include "conf.d/local/config/sources//.conf" 47
syslog-ng checking config sc4s version=3.19.0 Error parsing parser expression, syntax error, unexpected LL_IDENTIFIER, expecting '}' in parser generator app-parser:274:18-274:47: 269 270 host("hsradus" type(glob) flags(ignore-case)) 271 272 }; 273 parser { 274---> app-dest-cisco_acs-postfilter(); 274---> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 275 }; 276 rewrite { 277 set-tag('.app.app-dest-cisco_acs-postfilter'); 278 set('app-dest-cisco_acs-postfilter' value('.app.name')); 279 };
Included from /etc/syslog-ng/conf.d/plugin/app_parser_topics.conf:32:5-32:39: 27 parser app-plugin-syslog-fix-program{ 28 app-parser(topic(fix-invalid-program)); 29 }; 30 31 parser app-plugin-source-postprocess{ 32----> app-parser(topic(sc4s-postfilter)); 32----> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 33 }; 34 35 parser app-plugin-source-finalprocess{ 36 app-parser(topic(sc4s-finalfilter)); 37 };
Included from /etc/syslog-ng/syslog-ng.conf:42:1-42:1: 37 38 @include "conf.d/enrich/.conf" 39 @include "conf.d/enrich//.conf" 40 41 @include "conf.d/plugin/.conf" 42----> 42----> ^ 43 @include "conf.d/sources/.conf" 44 @include "conf.d/sources//.conf" 45 @include "conf.d/local/config/sources/.conf" 46 @include "conf.d/local/config/sources//.conf" 47