cef_ext_escape()¶

Purpose¶

Escapes a string for safe use as a CEF extension field value.

Syntax¶

cef_ext_escape(value)

Parameters¶

value: The string to escape.

Return Value¶

Returns the escaped string with the following substitutions applied per the CEF spec:

Backslash \ becomes \\
Equals sign = becomes \=
Newline becomes \n
Carriage return becomes \r

Use this function when embedding dynamic rsyslog property values inside the extensions argument of tocef(). The extensions argument itself is appended verbatim by tocef(), so any = or \ in a value must be escaped before concatenation.

Examples¶

# Escape a file path containing backslashes
set $!ext = cef_ext_escape("C:\\dir\\file.txt");
# Result: C:\\dir\\file.txt

# Escape a value containing an equals sign
set $!ext = cef_ext_escape("status=ok");
# Result: status\=ok

# Use inside tocef()
set $!cef = tocef("0", "MyVendor", "rsyslog", "1.0",
                  $syslogtag, $msg, "5",
                  "filePath=" & cef_ext_escape($!path) &
                  " msg="     & cef_ext_escape($msg));

See Also¶

tocef() - Build a complete CEF header string

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2026 Rainer Gerhards and others. Licensed under the Apache License 2.0.