On Mon, 2012-01-16 at 09:22 -0500, Patrick Hemmer wrote:
source s_apache { log { source { file("/var/log/apache/error.log"); }; parser(p_apache_parser); }; }; };
log { source(s_apache); ... };
This just doesnt feel right. I'm not quire sure how else to put it :-) I mean that I think of `log` statements as output handlers for a message. They control how the message leaves syslog-ng, whether it be to a file, database, pipe, whatever. To me it seems to make more sense if the `log` statement is called something else here (inside the `source` block), though what I dont know. Maybe at the least an alias, so that log and the alias are the exact same things, but that reading the config would make it look more logical.
Sure, I was also thinking hard what keywords to use in this case. Internally a log {} is called a "sequence", but sure an alias would be easy to do. Do you perhaps have a suggestion? I'm not a native English speaker, thus naming thing is sometimes difficult for me.
I dont know if I'm understanding the distinctions between `log` and `junctions` properly, but it seems as if `log`s are a serial execution of the statements within, and `junction`s are a parallel execution of the statements within, so maybe names to better reflect this?
The functionality is exactly as you have described.
-- Bazsi