nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Andre <andre-li...@fucs.org>
Subject Re: ParseCEF processor fails when Msg field exceed 1023 characters
Date Fri, 04 Jan 2019 09:33:42 GMT
Otto,

The parser should fail in that case (and many others).

https://github.com/fluenda/ParCEFone/blob/master/src/main/java/com/fluenda/parcefone/event/CefRev23.java#L327

Cheers

On Fri, Jan 4, 2019 at 10:05 AM Otto Fowler <ottobackwards@gmail.com> wrote:

> Can I ask how you are sure it is the message size that is causing the
> error?  The parser returns null for any error parsing, so the processor
> doesn’t know what happened.  It could be that the message didn’t validate,
> or something else.
>
> If the issues _is_ with the validator, then we could allow a property to
> optionally call the parser with the do validate flag to false.
>
> Maybe you can create a jira with a sanitized example line that causes the
> error?
>
>
>
>
> On January 3, 2019 at 15:13:14, Felix McPherson (ljungpipare@yahoo.se)
> wrote:
>
> Hi,
> I'm using the ParseCEF processor to parse CEF message to Json format.
> Unfortunately the ParseCEF processor fails for message/events that holds a
> string in the Msg field that has more than 1023 character. According to the
> CEF standard the Msg field in an event shall not exceed 1023 character. The
> PARSECEF fails with:
>
> "Error
> ParseCEF[id=...] Failed to parse...
> ...as a CEF message; it does not conform to the CEF standard; routing to
> failure.
>
> Any ideas on a workaround for this problem? I would prefer not having to
> remove character in the Msg field string.
> Regards,lj
>
>

Mime
View raw message