I only got warnings and not errors, when trying to use this in my XML file:
<value name="seq-matches">su(pam_unix)</value>
how did you execute syslog-ng so you got the error above? The only case where this is an error, if you are using "@version: 4.0"
This was the warning produced (both by syslog-ng and pdbtool):
WARNING: the template specified in value()/<value> options for your grouping-by() or db-parser() configuration has been changed to support typing from syslog-ng 4.0. You are using an older config version and your template contains an unrecognized type-cast, probably a parenthesis in the value field. This will be interpreted in the `type(value)' format in future versions. Please add an explicit string() cast as shown in the 'fixed-value' tag of this log message or remove the parenthesis. The value will be processed as a 'string' expression; config-version='3.38', name='seq-matches', value='su(pam_unix)', fixed-value='string(su(pam_unix))'
I chose to embed the type-hint field in the body of the <value> tag, as this is the format that is used everywhere else. I might be able to bump the db-parser XML file version, in the file header:
<patterndb version='5'>
I could bump this up to version 6, in which case you'd only need to add the type-hint if you also bumped the version number. That I think is doable.
On the documentation front, there's an XML schema in the source tree under the doc/xsd/ directory for each version of patterndb, and I assume the documentation also has a chapter on the db-parser() format.