<div dir="ltr">Hi,<br><br><br><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Mon, Nov 2, 2015 at 6:39 AM, Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@madhouse-project.org" target="_blank">algernon@madhouse-project.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Sat, Oct 31, 2015 at 1:28 PM, Scheidler, Balázs<br>
<<a href="mailto:balazs.scheidler@balabit.com">balazs.scheidler@balabit.com</a>> wrote:<br>
> Hi,<br>
><br>
> I've encountered a case where format-json orders keys not alphabetically,<br>
> but rather in the other direction. Can you remember any reason for that?<br>
<br>
</span>It's for the flat format => structured format conversion. Consider you<br>
have keys like a.b.c, a.b.d, a.b.e, a.c.a, a.c.f. With reverse<br>
sorting, you get a.c.f first, and generate an f key, then a, and<br>
collect that into c. Then you get the b stuff, and then wrap them all<br>
in a. It may be possible to do it the other way around, generating a<br>
first, and extending it, but this order is more straightforward in my<br>
opinion.<br></blockquote><div><br></div><div>It seems to have worked by flipping the order, but maybe I wasn't testing it enough. I don't understand your example, though, "f", then "a", then "c", the original example was a.c.f<br><br></div><div>But since there's a definite reason for the ordering, I'm dropping the reordering patch.<br></div><div><br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
I also seem to remember needing this for array support, but I'm not<br>
exactly sure of that.<br></blockquote><div><br></div><div>this makes sense at least as long as the index is alphabetically sortable (e.g. the same length), with stuff where indexes contain variable length numbers (10 sorts before 9), it probably wouldn't work.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
As for getting rid of sorting: that'd just make things slower in the<br>
end, unless syslog-ng starts storing its key-value pairs in an already<br>
structured format. But even then, my gut feeling is that sorting is<br>
still faster. If the data is unsorted, you'd have to hunt down where<br>
to insert the new keys, possibly deep into other structures. That<br>
sounds very inefficient. Also considerably more code</blockquote><div><br></div><div>Yup, sorting is an architectural must at least now. <br></div></div><br></div></div>