mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-06-06 10:49:44 +00:00
Tag drop{} statements per content-hub convention
Google's content-hub parsers tag dropped logs (drop { tag => "TAG_..." })
so they surface correctly in the unparsed-log views, rather than bare drop{}.
Use TAG_MALFORMED_ENCODING for the two JSON-extraction/parse failures (matches
content-hub) and TAG_UNSUPPORTED for valid JSON that matches no parsedmarc
report shape.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -177,7 +177,7 @@ filter {
|
||||
on_error => "no_json_payload"
|
||||
}
|
||||
if [no_json_payload] {
|
||||
drop {}
|
||||
drop { tag => "TAG_MALFORMED_ENCODING" }
|
||||
}
|
||||
|
||||
json {
|
||||
@@ -185,7 +185,7 @@ filter {
|
||||
on_error => "not_json"
|
||||
}
|
||||
if [not_json] {
|
||||
drop {}
|
||||
drop { tag => "TAG_MALFORMED_ENCODING" }
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
@@ -232,7 +232,7 @@ filter {
|
||||
|
||||
# Not a parsedmarc record we recognize: drop rather than emit an invalid event.
|
||||
if [report_type] == "" {
|
||||
drop {}
|
||||
drop { tag => "TAG_UNSUPPORTED" }
|
||||
}
|
||||
|
||||
# ===========================================================================
|
||||
|
||||
Reference in New Issue
Block a user