nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Otto Fowler <ottobackwa...@gmail.com>
Subject Re: ParseCEF processor fails when Msg field exceed 1023 characters
Date Thu, 03 Jan 2019 23:04:58 GMT
Can I ask how you are sure it is the message size that is causing the
error?  The parser returns null for any error parsing, so the processor
doesn’t know what happened.  It could be that the message didn’t validate,
or something else.

If the issues _is_ with the validator, then we could allow a property to
optionally call the parser with the do validate flag to false.

Maybe you can create a jira with a sanitized example line that causes the
error?




On January 3, 2019 at 15:13:14, Felix McPherson (ljungpipare@yahoo.se)
wrote:

Hi,
I'm using the ParseCEF processor to parse CEF message to Json format.
Unfortunately the ParseCEF processor fails for message/events that holds a
string in the Msg field that has more than 1023 character. According to the
CEF standard the Msg field in an event shall not exceed 1023 character. The
PARSECEF fails with:

"Error
ParseCEF[id=...] Failed to parse...
...as a CEF message; it does not conform to the CEF standard; routing to
failure.

Any ideas on a workaround for this problem? I would prefer not having to
remove character in the Msg field string.
Regards,lj

Mime
View raw message