[syslog-ng] value-pairs and sdata

Balazs Scheidler bazsi at balabit.hu
Thu May 19 11:23:33 CEST 2011


we had a conversation with Algernon a couple of weeks ago how mongodb should handle value collisions which arise when both the SDATA and the .SDATA.<id>.<param> values are to be added to the document.

As a reminder, mongodb strips the initial dot, and subsequent dots are used to break down values as subdocuments. This means that at the top level both SDATA as value and SDATA as a document are present.

I found out the following solution, which is a change in how mongodb currently works. I'd like to do this before releasing 3.3beta. Feedback is welcome.

 * the SDATA macro is not included in rfc5424, selected-macros, but can be explicitly specified by key(), pair() and it's still included in all-macros
 * a new "sdata" scope is introduced which expands to the .SDATA.<id>.<param> values, but the SDATA is not included either.
 * nv-pairs is split: nv-pairs contains values which have no leading dot, dot-nv-pairs only contains the ones that have leading dots. all-nv-pairs contain both.

This way, SDATA macro is only included if someone really wants it, thus collision is much less likely. Also, I'd like to replace the initial dot in mongodb to initial underscore, this way eliminating the possibility of collisions completely.

I've a half baked patch, but nothing complete yet. However I'd really like to push the beta version out ASAP, and this one is keeping it back.

Thanks for any comments.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110519/2edb34f0/attachment.htm 

More information about the syslog-ng mailing list