Balazs Scheidler <bazsi@balabit.hu> writes:
On Tue, 2011-10-04 at 10:56 +0200, Gergely Nagy wrote:
So I came up with a different syntax: wiring rekey into the key() option of value-pairs! That way, we already selected a subset to work on, and the transformations would apply to only those.
(This could be combined with the global syntax aswell, though)
So it'd look something like this:
value-pairs( scope("everything") key(".secevt.*" rekey(add-prefix("events"))) key(".classifier.*" rekey(add-prefix("syslog-ng"))) key(".sdata.*" rekey(shift(1))) key(".*" rekey(replace ("." "_"))) );
Doing this proved to be more difficult than originally anticipated, so I ended up with something inbetween (which, eventually, will be turned into the syntax above): value-pairs( scope(everything) rekey(".cee.*" shift(4) add-prefix("Events") replace("Events.move_me_to_the_top" "moved_to_the_top") ) rekey(".classifier.*" add-prefix("syslog-ng")) reley(".sdata.*" shift(1)) rekey(".*" replace("." "_")) );
We've discussed this IRL and came to the conclusion that it is very handy to allow key-rewrite to be applied on a per-glob basis (e.g. to associate the rewrite function to the set specified by --key).
This is now (partially) done on my feature/3.4/value-pairs/rekey branch. Since it's still a work in progress, I'm not including the merged patches yet, but give a pointer to a diff between 3.4 master and my branch instead: https://github.com/algernon/syslog-ng/compare/algernon:upstream/mirror/3.4.....
Something along the lines of:
$(format-json --key .cee.* --rewrite replace .cee=Event)
This is not done yet, either. I'll make key() take a glob first, then proceed with the commandline support. -- |8]