[syslog-ng] [PATCH 0/3]: value-pairs() & related patches

Gergely Nagy algernon at balabit.hu
Sun Apr 24 11:18:55 CEST 2011


Hi!

For a multitude of reasons, ranging from the feature freeze looming over
my head to hope that discrete patches are easier to review and merge
than my awfully chaotic git tree, I'll be posting a couple of patches in
a short while, as soon as I figure out what magic arguments I need to
give to git send-email to make it send the batch the way I imagined.

value-pairs()
=============

The first one will be the value-pairs() implementation (also available
on my integration/value-pairs branch), which is the base of the two
others that will follow.

While the value-pairs() implementation could still use some work,
especially in the performance department, I believe it's good enough for
initial use, and the benefits of having it (so that the mongodb driver
can make use of it) far outweight the downsides.

The implementation itself is reasonably light, it hardly touches
anything outside it's own two files: the grammar and the makefile only,
to hook itself in. If not used by a driver, then it does not change
functionality at all. Therefore, I believe this could go in before the
feature freeze.

afmongodb value-pairs() port
============================

The next patch will be the port of the already existing mongodb
destination driver to use value-pairs(). Also available on my
integration/afmongodb-vp branch.

This means that the driver will finally be able to do what it's good at:
store arbitrary information in the database: whether that information
comes via SDATA or patterndb, it doesn't matter, it will be stored in a
structured manner.

In my opinion, this is the major selling point of the mongodb
destination driver at the moment (I have some other grand plans with it
in the future, but that's more invasive, less important, and can easily
wait 'till 3.4 ;). Without value-pairs(), afmongodb is pretty much
useless.

tfson()
=======

For extra fun & profit, Balint Kovacs' format_json has been ported to
use value-pairs(), and this will be the third patch in the series, and
is also available on my integration/tfjson branch.

This one's the least important, though it's dead simple, therefore I'd
be very happy if it made past the feature freeze aswell.

-- 
|8]



More information about the syslog-ng mailing list