[Tutor] multipart socket streaming problem: the delimiters

richard kappler richkappler at gmail.com
Tue Jan 5 10:42:59 EST 2016


This is a continuation of the thread 'reading an input stream' I had to
walk away from for a few days due to the holidays and then other work
considerations, and I figured it best to break my confusion into separate
chunks, I hope that's appropriate. In short, my script needs to read a
stream of xml data from a socket (port 2008), the data coming in from as
many as 30 different machines, but usually 4 or less, as many as 3 messages
per second from each machine at times, messages block format delimited by
stx(\x02) and etx (\x03), send the data in those blocks to a parser
(already built using lxml and an xslt file) and send it out to splunk using
a native 'event writer'.

Once I figure out how to get the messages in and read in general (my
current test file has only one message) I'll need to figure out how to pull
them, one at a time (one message from stx to etx) and send to the parser. I
am totally lost here. Once I can get the data read from stream rather from
file, how do I write the part of the script that recognizes block format?
I've looked for libraries but am apparently not writing a good search, as I
always get sites that discuss blocking and non-blocking sockets, not block
format messages. Is there a library or tutorial out there anyone knows of
that might help with this?

regards, Richard


More information about the Tutor mailing list