[syslog-ng] advice/assistance with parsing attempt requested

[Matthew Hall]

On Wed, Dec 08, 2010 at 09:47:48PM +0100, Balazs Scheidler wrote:
> Although I really like the ideas floating around, the best way to
> address this issue is to write a welf parser plugin to syslog-ng which
> simply produces name-value pairs from the input, without having to pipe
> them out to an external process.
> 
> The round-trip (pipe-write, pipe-read, process, pipe-write, pipe-read)
> is simply enormous. 
> 
> And 3.2 already has plugins in place, so we only need someone
> volunteering to write a welf parser. :)
> 
> Something along the lines of:
> 
> parser { welf-parser(prefix(".welf")); };
> 
> Which would put all name-value pairs in the input into name-value pairs,
> prefixed with '.welf', e.g. name1=value1 would become an NV pair in
> syslog-ng with the name ${.welf.name1} and value "value1".
> 
> Does that make sense? Or I'm missing something?

As a C programmer who makes heavy use of welf it's on my roadmap. But so 
far I was able to make my WELF usage work with patterndb because my 
fields have a predictable order.

So hopefully I'll be able to get to it some time in the next month or 
two if nobody else can do it before then.

Matthew.