[syslog-ng] RFC: value-pairs key rewrite framework, part N+1
Gergely Nagy
algernon at balabit.hu
Sat Nov 12 19:59:49 CET 2011
Gergely Nagy <algernon at balabit.hu> writes:
> Ladies and gentlemen, I present you the final piece of the value-pairs
> key rewrite patchset:
Well, that wasn't that final, afterall! After talking it through with
Bazsi, a few changes were still made:
* rekey() exists on its own no longer, it's a sub-option of key() now,
and uses the same glob.
Likewise, the command-line parser received similar treatment.
The result is still available on my feature/3.4/value-pairs/rekey
branch, and the complete diff between 3.4 and the branch is at the
following location:
https://github.com/algernon/syslog-ng/compare/algernon:upstream/mirror/3.4...feature/3.4/value-pairs/rekey
So, we can now write stuff like this:
value-pairs(key(".cee.*" rekey(shift(4) add-prefix("Event")
replace("Event.foo" "foo"))))
Or, the same thing in template function syntaxt:
$(format-json --key .cee.* --rekey --shift 4 --add-prefix Event --replace Event.foo=foo)
I think this makes the syntax easier, and more straightforward.
Any comments, criticism or ideas are welcome!
I plan to fold my branch into at most a few distinct commits, and then
request a merge sometime during next week.
--
|8]
More information about the syslog-ng
mailing list