[MINOR] halog: support backslash-escaped quotes

Some syslog servers escape quotes, which make the resulting logs unusable
for URL processing since the parser looks for the first field beginning
with a quote. It now supports also fields starting with backslash and
quote in order to address this. No performance impact was measured.

diff --git a/contrib/halog/halog.c b/contrib/halog/halog.c
index 39e4320c847d29b347e65baa45b6b6a8bd84bd46..32ca6709937f053c43599fa1297410988abaa6ff 100644 (file)
--- a/contrib/halog/halog.c
+++ b/contrib/halog/halog.c
@@ -1127,8 +1127,12 @@ void filter_count_url(const char *accept_field, const char *time_field, struct t
         * if there's nothing else.
         */
        e = field_start(e, METH_FIELD - TIME_FIELD + 1); // avg 100 ns per line
-       while (*e != '"' && *e)
+       while (*e != '"' && *e) {
+               /* Note: some syslog servers escape quotes ! */
+               if (*e == '\\' && e[1] == '"')
+                       break;
                e = field_start(e, 2);
+       }
 
        if (unlikely(!*e)) {
                truncated_line(linenum, line);