[syslog-ng] Using macro substring as another macro

[Balazs Scheidler]

On Thu, 2011-04-07 at 15:20 +0200, Gergely Nagy wrote:
> Jakub Jankowski <shasta at toxcorp.com> writes:
> 
> > I'd like to implement simple hashing in file() destination, mainly to avoid 
> > ext3 32k directories limit, but also for convenience. Is it possible to do 
> > something simliar what this shell snippet does:
> >
> > $ NAME=value
> > $ echo ${NAME[*]:0:1}
> > v
> > $
> >
> > but for macros (especially those coming from parsers)?
> 
> Off the top of my head: no, it's not currently possible with stock
> syslog-ng (except with some dirty hacks I'd rather not share). On the
> other hand, writing a template function that would do just what you want
> should be very very easy.
> 
> > What I want is logs written to /var/log/h/ho/hos/hostname/service.log (with 
> > configurable level of subdirs) using a single destination().
> 
> I can throw together a patch that would introduce a $(substr START END
> STR) template function, which you could use like this:
> 
> destination d_file {
>  file ("/var/log/$(substr 1 1 ${HOST})/$(substr 1 2 ${HOST})/$(substr 1 3 ${HOST})/${HOST}/service.log");
> };
> 
> It's a bit more verbose than ${NAME[*]:0:1}, but does pretty much the
> same thing.
> 
> I'll knock something up either tonight or sometime tomorrow, both for
> syslog-ng 3.2 and for 3.3 aswell. On the other hand, if you have basic C
> knowledge, you can do this too, and it's actually quite fun to do so!
> 
> I've written a short blog post a few months ago about writing trivial
> template functions, that should be enough to get you started:
> 
> http://algernon.blogs.balabit.com/2011/01/howto-write-a-simple-template-function-for-syslog-ng/
> 
> If anyone beats me to it: you're my guest for your (reasonable) choice
> of beverage if you ever come to Hungary, or wherever we might meet.
> 

Ah, I didn't know that article, but it's definitely worth a read, who
has a seemingly complex issue with generating filenames or content.

PS: I'm thinking about how to invent a complete functional language in
syslog-ng template functions, yammm :) No, not really :)


-- 
Bazsi