From 67cf88cddd9525d74cdcf38af3b868b9eb8c44e2 Mon Sep 17 00:00:00 2001
From: James / hach1yon <32596618+hach1yon@users.noreply.github.com>
Date: Sun, 27 Mar 2022 22:26:42 +0900
Subject: [PATCH] fix degrade for pull req #464 (#468)

* fix degrade for pull req #464

* add trim
---
 src/detections/print.rs | 4 +++-
 src/detections/utils.rs | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/detections/print.rs b/src/detections/print.rs
index fcd031f1..dff39245 100644
--- a/src/detections/print.rs
+++ b/src/detections/print.rs
@@ -116,7 +116,9 @@ impl Message {
             if is_exist_event_key {
                 let hash_value = get_serde_number_to_string(tmp_event_record);
                 if let Some(hash_value) = hash_value {
-                    let hash_value = hash_value.replace(r"(\\a|\\f|\\t|\\n|\\r|\\v)", " ");
+                    // UnicodeのWhitespace characterをそのままCSVに出力すると見難いので、スペースに変換する。なお、先頭と最後のWhitespace characterは単に削除される。
+                    let hash_value: Vec<&str> = hash_value.split_whitespace().collect();
+                    let hash_value = hash_value.join(" ");
                     hash_map.insert(full_target_str.to_string(), hash_value);
                 }
             }
diff --git a/src/detections/utils.rs b/src/detections/utils.rs
index 0dd1a6c6..8dc39e5c 100644
--- a/src/detections/utils.rs
+++ b/src/detections/utils.rs
@@ -54,7 +54,7 @@ pub fn value_to_string(value: &Value) -> Option<String> {
         Value::Null => Option::None,
         Value::Bool(b) => Option::Some(b.to_string()),
         Value::Number(n) => Option::Some(n.to_string()),
-        Value::String(s) => Option::Some(s.to_string()),
+        Value::String(s) => Option::Some(s.trim().to_string()),
         Value::Array(_) => Option::None,
         Value::Object(_) => Option::None,
     }