Description
Parse one restricted RFC5424 structured-data name="value" parameter and its escaped quote/backslash/right-bracket rules; no whole syslog message or unescaping unknown sequences.
Syslog structured data uses parameter names and quoted values with its own escape rules. A decoded parameter remains distinct from a complete structured-data element, message header, or authenticated log record. Local token grammar and full protocol validation answer different questions.
Parse one restricted RFC5424 structured-data name="value" parameter and its escaped quote/backslash/right-bracket rules; no whole syslog message or unescaping unknown sequences.
When to use this tool
Use Parsing: Syslog Sdid Parameter Token when you need to decode one supported structured-data parameter token.
How to use the tool and how it works
- Enter token. Use the units and conventions below.
- Run the tool. Correct any format, range, or cross-field input error before interpreting the output.
- Read result. Expand result to inspect the returned fields.
Split at the first = and require a 1-32-character printable ASCII parameter name excluding =,],double quote, and space. Require a double-quoted value, decode only escaped backslash, double quote, and ], and reject unescaped quotes, ], CR, or LF. Return name and decoded value inside result.1
Syslog structured-data values use quoted parameters with special treatment for the quote, backslash, and closing bracket. Full protocol validation also needs the surrounding structured-data and message grammar.2
| Input field | Meaning and units | Accepted input |
|---|---|---|
| token | Complete literal token in the grammar stated above. | Required. Text. Implementation limit: 8192 Unicode code points and 16384 UTF-16 code units. |
| Output field | Interpretation | Returned shape |
|---|---|---|
| result | Object containing the calculated result members described below. | Required. Object. |
| result.name | Name | Calculated result member: string. |
| result.value | Value | Calculated result member: string. |
{
"input": {
"token": "key=\"a\\]b\""
},
"output": {
"result": {
"name": "key",
"value": "a]b"
}
}
}Limitations and assumptions
- This parses one supplied structured-data parameter, not a complete syslog message or SD element. Other control characters in the value are not comprehensively screened by this recognizer, and no log authenticity or transport validity is established.
- Outputs are nested inside result. Inputs must satisfy both the field types and the cross-field conditions above. Invalid input causes an error; a successful false flag or documented placeholder is a different result.
Alternative or Complementary methods
Use a complete syslog parser for headers, structured-data elements, encoding, framing, and transport rules. Check provenance independently when the authenticity of a log record matters.
References
-
Calculation and input contract: parse/syslog-sdid-parameter-token — tool.io
-
RFC 5424: Structured Data Parameters — IETF / RFC Editor
Similar or alternative tools
- Parsing: Mime Quoted Parameter Unescape
Unescape one restricted ASCII MIME quoted-string parameter, honoring quoted-pair escapes and rejecting raw quotes, controls and line folding.
- HTTP Link Parameter Single Quoted Token
Parse an HTTP name and double-quoted parameter value, lowercasing the name and removing supported backslash escapes.