feat: improve ParseKV function to handle unquoted values with spaces

- Replace regex-based parsing with scanner approach for better handling of complex key-value pairs
- Add support for unquoted values containing spaces (e.g., UNIFIhost=Express 7)
- Maintain backward compatibility with existing quoted and simple unquoted values
- Add robust filtering to prevent false positives from invalid key patterns
- Improve quote handling and escaping for quoted values
- Add comprehensive test cases covering edge cases and mixed scenarios

Fixes parsing issues with CEF logs and other formats where values contain spaces without quotes.

Author: LaurenceJJones

pkg/exprhelpers/exprlib_test.go

@@ -2184,6 +2184,48 @@ func TestParseKv(t *testing.T) {
 			want:  map[string]string{"bar": "toto", "foo": ""},
 			expr:  `ParseKV(value, out, "a")`,
 		},
+		{
+			name:  "ParseKV() test: unquoted value with spaces",
+			value: `UNIFIhost=Express 7 port=443`,
+			want:  map[string]string{"UNIFIhost": "Express 7", "port": "443"},
+			expr:  `ParseKV(value, out, "a")`,
+		},
+		{
+			name:  "ParseKV() test: mixed quoted and unquoted with spaces",
+			value: `msg="Hello World" host=My Server name=test`,
+			want:  map[string]string{"msg": "Hello World", "host": "My Server", "name": "test"},
+			expr:  `ParseKV(value, out, "a")`,
+		},
+		{
+			name:  "ParseKV() test: escaped quotes in quoted value",
+			value: `msg="He said \"Hello\"" status=ok`,
+			want:  map[string]string{"msg": `He said "Hello"`, "status": "ok"},
+			expr:  `ParseKV(value, out, "a")`,
+		},
+		{
+			name:  "ParseKV() test: escaped backslashes in quoted value",
+			value: `path="C:\\Program Files\\App" status=running`,
+			want:  map[string]string{"path": `C:\Program Files\App`, "status": "running"},
+			expr:  `ParseKV(value, out, "a")`,
+		},
+		{
+			name:  "ParseKV() test: empty unquoted value at end",
+			value: `host=server port=443 debug=`,
+			want:  map[string]string{"host": "server", "port": "443", "debug": ""},
+			expr:  `ParseKV(value, out, "a")`,
+		},
+		{
+			name:  "ParseKV() test: complex CEF-like log",
+			value: `CEF:0|Ubiquiti|UniFi|7.4.162|login|User Login|3|src=192.168.1.100 duser=admin msg=User login successful UNIFIhost=Express 7 UNIFIport=443`,
+			want:  map[string]string{"src": "192.168.1.100", "duser": "admin", "msg": "User login successful", "UNIFIhost": "Express 7", "UNIFIport": "443"},
+			expr:  `ParseKV(value, out, "a")`,
+		},
+		{
+			name:  "ParseKV() test: robust parsing with mixed valid and invalid patterns",
+			value: `valid_key=value1 some_text_without_equals another-valid.key=value2 _valid_key=value3`,
+			want:  map[string]string{"valid_key": "value1 some_text_without_equals", "another-valid.key": "value2", "_valid_key": "value3"},
+			expr:  `ParseKV(value, out, "a")`,
+		},
 	}
 
 	for _, tc := range tests {

pkg/exprhelpers/helpers.go

@@ -60,7 +60,7 @@ func init() { //nolint:gochecknoinits
 	}
 }
 
-var keyValuePattern = regexp.MustCompile(`(?P<key>[^=\s]+)=(?:"(?P<quoted_value>[^"\\]*(?:\\.[^"\\]*)*)"|(?P<value>[^=\s]+)|\s*)`)
+var keyStart = regexp.MustCompile(`([a-zA-Z_][a-zA-Z0-9_.-]*)=`) // More restrictive key pattern
 
 var (
 	geoIPCityReader  *geoip2.Reader
@@ -950,45 +950,109 @@ func ParseKV(params ...any) (any, error) {
 	target := params[1].(map[string]any)
 	prefix := params[2].(string)
 
-	matches := keyValuePattern.FindAllStringSubmatch(blob, -1)
-	if matches == nil {
+	if _, ok := target[prefix]; !ok {
+		target[prefix] = make(map[string]string)
+	} else if _, ok := target[prefix].(map[string]string); !ok {
+		log.Errorf("ParseKV: target is not a map[string]string")
+		return nil, errors.New("target is not a map[string]string")
+	}
+
+	km := target[prefix].(map[string]string)
+
+	// Find all key= occurrences and slice values between them.
+	idxs := keyStart.FindAllStringSubmatchIndex(blob, -1)
+	if len(idxs) == 0 {
 		log.Errorf("could not find any key/value pair in line")
 		return nil, errors.New("invalid input format")
 	}
 
-	if _, ok := target[prefix]; !ok {
-		target[prefix] = make(map[string]string)
-	} else {
-		_, ok := target[prefix].(map[string]string)
-		if !ok {
-			log.Errorf("ParseKV: target is not a map[string]string")
-			return nil, errors.New("target is not a map[string]string")
+	// Filter out matches that are inside quoted values
+	validIdxs := make([][]int, 0, len(idxs))
+	for _, m := range idxs {
+		keyStart := m[0]
+		// Check if this key= is inside a quoted value by looking backwards
+		if !isInsideQuotedValue(blob, keyStart) {
+			validIdxs = append(validIdxs, m)
 		}
 	}
 
-	for _, match := range matches {
-		key := ""
-		value := ""
+	if len(validIdxs) == 0 {
+		log.Errorf("could not find any key/value pair in line")
+		return nil, errors.New("invalid input format")
+	}
+
+	for i, m := range validIdxs {
+		// m layout: [ fullStart, fullEnd, group1Start, group1End ]
+		key := blob[m[2]:m[3]]
+		valStart := m[1] // right after '='
 
-		for i, name := range keyValuePattern.SubexpNames() {
-			switch {
-			case name == "key":
-				key = match[i]
-			case name == "quoted_value" && match[i] != "":
-				value = match[i]
-			case name == "value" && match[i] != "":
-				value = match[i]
-			}
+		var valEnd int
+		if i+1 < len(validIdxs) {
+			valEnd = validIdxs[i+1][0] // start of next key
+		} else {
+			valEnd = len(blob)
 		}
 
-		target[prefix].(map[string]string)[key] = value
+		raw := strings.TrimSpace(blob[valStart:valEnd])
+		val := parseValue(raw)
+		km[key] = val
 	}
 
 	log.Tracef("unmarshaled KV: %+v", target[prefix])
-
 	return nil, nil
 }
 
+// parseValue handles quoted and unquoted values.
+// - If it begins with a quote, it removes the surrounding quotes
+//   if the closing one is present and unescapes \" and \\.
+// - Otherwise, returns the string as-is (already trimmed).
+func parseValue(s string) string {
+	if s == "" {
+		return ""
+	}
+	if s[0] == '"' {
+		// Try to find a terminal unescaped quote.
+		// Because we bounded by next key=, s will usually end right at the quote
+		// (plus optional whitespace already trimmed). We still handle cases safely.
+		if len(s) >= 2 && s[len(s)-1] == '"' {
+			body := s[1 : len(s)-1]
+			// Unescape common sequences: \" and \\ (CEF-style logs rarely need more)
+			body = strings.ReplaceAll(body, `\\`, `\`)
+			body = strings.ReplaceAll(body, `\"`, `"`)
+			return body
+		}
+		// No closing quote found in slice; fall back to stripping leading quote only.
+		return strings.TrimPrefix(s, `"`)
+	}
+	return s
+}
+
+// isInsideQuotedValue checks if a position in the string is inside a quoted value
+// by counting unescaped quotes before the position
+func isInsideQuotedValue(s string, pos int) bool {
+	inQuote := false
+	
+	for i := 0; i <= pos && i < len(s); i++ {
+		if s[i] == '"' {
+			// Check if this quote is escaped
+			escaped := false
+			backslashCount := 0
+			for j := i - 1; j >= 0 && s[j] == '\\'; j-- {
+				backslashCount++
+			}
+			if backslashCount%2 == 1 {
+				escaped = true
+			}
+			
+			if !escaped {
+				inQuote = !inQuote
+			}
+		}
+	}
+	
+	return inQuote
+}
+
 func Hostname(params ...any) (any, error) {
 	hostname, err := os.Hostname()
 	if err != nil {