though only for a finite number of fields. If you use generic names for your extractions "@NUMBER:i0:@ @NUMBER:i1:@ @ESTRING:s0:%@ etc. then your single template works for any message:
I understood the suggestion. This is the point I'm trying to make: If I'm using, for example, the community patterndb database, then the metadata includes named values (e.g., "flowevt.src_ip") that I may not be aware of in advance. Furthermore, the values associated with a given class may change as the pattern database changes over time. This will inherently break any sort of positional schema. I am looking for way to extract all of the metadata names and values known to syslog-ng at the time the message is logged. I'm not wedded to a database solution; if I could generate a structured output format like XML or JSON I could obviously post-process in whatever fashion best suited my needs. I'm currently poking around the source to see if I can figure out how to do this.