/ 
Log-Munger-0.0.1
/ Log::Munger::RuleFileParser

NAME

Log::Munger::RuleFileParser - Reads a Log::Munger rule file into a rules hash.

VERSION

Version 0.0.1

SYNOPSIS

use Log::Munger::RuleFileParser;

my $parser = Log::Munger::RuleFileParser->new;
my $rules  = $parser->load( 'file' => 'sshd' );

print $rules->{'vars'}{'SSH_FAILED'} . "\n";

Loading a rule file is four steps. The name is resolved to a path via Log::Munger::WhichRuleFile, the YAML is read in, anything under includes is merged in with the file itself winning on a conflict (and an earlier include winning over a later one), and finally everything under vars_templated is run through Template and folded into vars.

That last step is why order matters: a templated var may reference another templated var, so Log::Munger::RulesTemplateOrder sorts them by dependency first and each one is resolved only once everything it references already is.

Trailing newlines are stripped from every var at every step. A YAML | block scalar keeps its terminating newline, and one of those landing in the middle of a composed pattern would quietly stop it matching single line logs.

METHODS

new

Creates a parser. Takes no arguments.

my $parser = Log::Munger::RuleFileParser->new;

load

Loads a rule file, merging its includes and resolving its templated vars.

Every resolved vars_templated entry is written back into $rules->{vars}, so by the time this returns there is one flat namespace of named regexps and vars_templated is only of interest for seeing how a var was written.

- file :: The file to load. Either a bare name resolved through the search
    path, such as "sshd", or a path. Required.
    Default :: undef

Returns the rules hash ref. Dies if the file cannot be found, is not valid YAML, does not parse to a hash, names an include that cannot be found, references a var that is not defined anywhere, or holds a var that will not template.

my $rules = $parser->load( 'file' => 'sshd' );

load_no_templating

Same as "load", but stops short of resolving vars_templated. The includes are still merged and the plain vars are still normalized, so what comes back is the rule file as written rather than as compiled.

This is what the template ordering tooling uses. Working out which var depends on which means reading the [% VAR %] references before they are substituted away.

- file :: The file to load. Either a bare name resolved through the search
    path, such as "sshd", or a path. Required.
    Default :: undef

Returns the rules hash ref, with vars_templated left untouched. Dies under the same conditions as "load", minus the templating.

my $rules = $parser->load_no_templating( 'file' => 'sshd' );