[MINOR] halog: support backslash-escaped quotes
Some syslog servers escape quotes, which make the resulting logs unusable
for URL processing since the parser looks for the first field beginning
with a quote. It now supports also fields starting with backslash and
quote in order to address this. No performance impact was measured.
diff --git a/contrib/halog/halog.c b/contrib/halog/halog.c
index 39e4320..32ca670 100644
--- a/contrib/halog/halog.c
+++ b/contrib/halog/halog.c
@@ -1127,8 +1127,12 @@
* if there's nothing else.
*/
e = field_start(e, METH_FIELD - TIME_FIELD + 1); // avg 100 ns per line
- while (*e != '"' && *e)
+ while (*e != '"' && *e) {
+ /* Note: some syslog servers escape quotes ! */
+ if (*e == '\\' && e[1] == '"')
+ break;
e = field_start(e, 2);
+ }
if (unlikely(!*e)) {
truncated_line(linenum, line);