Prototype: parsestringarrayidx(array, input, comment, split, maxentries, maxbytes)

Return type: int

Description: Populates the two-dimensional array array with up to maxentries fields from the first maxbytes bytes of the string input.

This function mirrors the exact behavior of readstringarrayidx(), but reads data from a variable instead of a file. By making data readable from a variable, data driven policies can be kept inline.

The comment field is a multiline regular expression and will strip out unwanted patterns from the file being read, leaving unstripped characters to be split into fields. Using the empty string ("") indicates no comments.

Arguments:

  • array: string - Array identifier to populate - in the range: [a-zA-Z0-9_$(){}\[\].:]+
  • input: string - A string to parse for input data - in the range: .*
  • comment: string - Regex matching comments - in the range: .*
  • split: string - Regex to split data - in the range: .*
  • maxentries: int - Maximum number of entries to read - in the range: 0,99999999999
  • maxbytes: int - Maximum bytes to read - in the range: 0,99999999999

Example:

code
body common control
{
      bundlesequence => { "test" };
}

bundle agent test(f)
{
  vars:
      # Define data inline for convenience
      "table"   string => "one: a
                           two: b
                         three: c";

      #######################################

      "dim" int => parsestringarrayidx(
                    "items",
                    "$(table)",
                    "\s*#[^\n]*",
                    ":",
                    "1000",
                    "200000"
      );

      "keys" slist => getindices("items");
      "sorted_keys" slist => sort(keys, "int");

  reports:
      "item $(sorted_keys) has column 0 = $(items[$(sorted_keys)][0]) and column 1 = $(items[$(sorted_keys)][1])";
}

Output:

code
R: item 0 has column 0 = one and column 1 =  a
R: item 1 has column 0 =                            two and column 1 =  b
R: item 2 has column 0 =                          three and column 1 =  c

History: Was introduced in version 3.1.5, Nova 2.1.0 (2011)