Mailing List Archive

sparse array - unexpected behaviour
Hi,
can someone please confirm my bad experience with sparse array:
create file for sparese json:
/tmp/a.json:
-----------------
{
"table": [.
{
"value": "interval 1st: 0 - 2147483647",
"index": 0
},
{
"value": "inrerval 2nd: 2147483648 - INFI",
"index": 2147483648
}
],
"type": "sparseArray",
"version": 1,
"nomatch": "no match"
}
---------
create config:
------
module(load="imptcp")
lookup_table( name="ip2asn_table" file="/tmp/a.json" reloadOnHUP="on")
template ( name="t_asn" type="list") {
property(name="msg")
constant(value=":ASN=")
property(name="$!asn")
constant(value="\n") }

ruleset( name="rs_asn_lookup" )
{


set $!asn = lookup("ip2asn_table",ltrim($msg));
action( type="omfile" File="/tmp/asn_lookup.out" template="t_asn")
}
input(type="imptcp" address="127.0.0.1" port="55555" ruleset="rs_asn_lookup"
)
-----------
send the event:
echo "<111>Jan 3 10:16:05 localhost rsyslogd: 2147483647" >/dev/tcp/
127.0.0.1/55555


and verify output in /tmp/asn_lookup.out
I got:
2147483647:ASN=inrerval 2nd: 2147483648 - INFI

but expected is interval 1st because value 2147483647 is less than
2147483648
what's wrong?

thank you.

m.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.