cfg-grammar: make it possible to create templates without braces

In a number of cases this syntax:

template foo {
    template("template text");
};

Has a lot of boilerplate. In case template-escape() option is not needed
(which is less-and-less needed and could probably be deprecated),
this syntax is just enough:

template foo "template text";

This plays nicely with the new feature that template functions can be defined in
configuration files with a similar syntax.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
plugin: add free_fn to Plugin instances

Traditionally Plugin instances are allocated as global variables, which
didn't need free operation. This patch allows allocating Plugin instances
dynamically, which in turn requires a free_fn.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
templates: add free_fn method to LogTemplateFunction

Just like with Plugins, LogTemplateFunctions couldn't really be subclassed,
as we basically assumed those are defined in a statically allocated struct.
With the upcoming support for user-defined template functions, we do need
to allocate these on the heap, thus a free operation is needed too.

This patch adds this free_fn, which should both free any dynamic data inside
the struct _and_ the struct itself.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
templates: don't allocate state if size_of_state is zero

The upcoming user template functions code does not have a state, and we
don't want to implement boilerplate free_state calls.  Make state optional
by specifying size_of_state as zero.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
templates: add implementation for user-defined template functions

This patch adds a new API, user_template_function_register() that allows
registering a LogTemplate instance as a template function, dynamically.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
cfg-grammar: add template-function support

This patch completes the support for user defined template functions. With
this patch you can define template functions in your configuration the same
way you would define a template.

template-function foobar "this is a template function running on $HOST";

destination d_file {
	file("something.log" template("$(foobar)\n"));
};

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
scl: add $(format-cim) template function

This patch adds a template function $(format-cim) into an SCL module
that implements Common Information Model (aka cim) formatting, as
used by Kibana (and Splunk).

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
system-source: parse @cim marked messages by json-parser automatically

This allows any local applications to submit JSON formatted messages
through the syslog() API, which will automatically be parsed. A ".cim."
prefix will be added to the fields extracted.

The same values can be reconstructed using a value-pairs expression,
something like:

  $(format-json --key .cim.* --shift 5)

Signed-off-by: Balazs Scheidler <bazsi@balabit.com>
Merge pull request #210 from balabit/f/parse-cim-json-messages-in-system

F/parse cim json messages in system
system-source: Bump the version in system-expand

Bump the version in system-expand, so new 3.7 features will be included
in the expanded system() when running the program.

Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
Merge pull request #212 from algernon/f/system-expand-3.7

system-source: Bump the version in system-expand
Merge pull request #216 from balabit/f/add-format-cim-template-function

F/add format cim template function
basicfuncs: add implementation for $(template)

This function makes it possible to invoke other templates defined
in the configuration, like this:

   $(template foobar)

Assuming "foobar" is defined as a global template, this will invoke that,
and place its result as the result of the $(template) function.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Merge pull request #196 from balabit/f/add-tf-template

F/add tf template
system-source: JSON parsing is enabled in 3.6 too

Correct a notice, so it says the CIM parsing is enabled since 3.6,
because the feature got merged to 3.6/master too.

Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>