[syslog-ng] RFC: value-pairs key rewrite framework, part N+1

Gergely Nagy algernon at balabit.hu
Sat Nov 12 19:59:49 CET 2011


Gergely Nagy <algernon at balabit.hu> writes:

> Ladies and gentlemen, I present you the final piece of the value-pairs
> key rewrite patchset:

Well, that wasn't that final, afterall! After talking it through with
Bazsi, a few changes were still made:

* rekey() exists on its own no longer, it's a sub-option of key() now,
  and uses the same glob.

  Likewise, the command-line parser received similar treatment.

The result is still available on my feature/3.4/value-pairs/rekey
branch, and the complete diff between 3.4 and the branch is at the
following location:

  https://github.com/algernon/syslog-ng/compare/algernon:upstream/mirror/3.4...feature/3.4/value-pairs/rekey

So, we can now write stuff like this:

 value-pairs(key(".cee.*" rekey(shift(4) add-prefix("Event")
                                replace("Event.foo" "foo"))))

Or, the same thing in template function syntaxt:

 $(format-json --key .cee.* --rekey --shift 4 --add-prefix Event --replace Event.foo=foo)

I think this makes the syntax easier, and more straightforward.

Any comments, criticism or ideas are welcome!

I plan to fold my branch into at most a few distinct commits, and then
request a merge sometime during next week.

-- 
|8]



More information about the syslog-ng mailing list