[syslog-ng] [PATCH (3.4)] afmongodb: Add support for datetime fields

[Gergely Nagy]

Balazs Scheidler <bazsi at balabit.hu> writes:

> Although I'd integrate this patch in this form, I have a different idea
> on how this and similar stuff should be implemented.
[...]
> This would generalize how the handling of DEFAULT values, which looks
> like this:
>
> destination d_sql {
>
> 	sql(columns('id', 'now datetime', 'bar'),
> 	    values("$ID", default, "$BAR"));
> };
>
> Here, 'default' means to use the default for the column. If
> value-pairs() could grow such a functionality, that would be great.

I'm not entirely sure how and where DEFAULT would fit into
value-pairs()...

> I'd probably call this function "casting", casting the output of the
> template to some destination specific type or function.
>
> This could look like this in mongodb:
>
>
> mongodb(
>         value-pairs(
>           key("MESSAGE")
>           pair("some.date", datetime("$UNIXTIME"))))

That's an option yeah, and not even too hard to make it happen, and it
would even be friendlier to future enhancements (such as types stored in
nvtable). This would also make the implementation simpler, the way I did
the type check in this patch isn't exactly nice.

> +template_content
> +        : string                               { /* simple template */ }
> +        | LL_IDENTIFIER '(' string ')'         { /* cast, store $1 together with the template to be interpreted by the caller */
> +        ;
> +

Mmmmhm. Neat. One thing that this is missing though, is a way to verify
that the specified type is available, and efficient storage for it: I
wouldn't really want to strcmp() it against N things during a
value_pairs_foreach(), nor do I wish to defer validating the cast until
then.

Having a global list of types would perhaps be useful, even if it's not
as flexible as it could be. (We'll need something like that for storing
types in nvtable later anyway, as far as I see)

> Then once the cast is stored together with LogTemplate, the users could
> use that to insert default values, or merely supply type information
> to a string formatted by templates.
>
> What do you think?

I like it!

> Do you want me to merge this patch anyway?

Nope, don't, I'll remove it from merge-queue/3.4, and redo it based on
the above suggestions.

-- 
|8]