[syslog-ng] mongodb and TTL collections

Gergely Nagy algernon at balabit.hu
Mon Jan 28 18:45:15 CET 2013


"Lucas, Sascha" <Sascha.Lucas at gisa.de> writes:

> Hi Gergely,
>
> Am Donnerstag, den 08.11.2012, 11:21 +0000 schrieb Gergely Nagy:
>> trying to estimate, it hardly ever works), but I just sent a patch to
>> the list for 3.4 that allows one to do this:
>> 
>> mongodb(datetime("some.field.name")
>>         value-pairs(pair("some.field.name", "$UNIXTIME")));
>> 
>
> was the patch you mention above accepted for syslog-ng-OSE-3.4rc2? ATM
> I'm trying this version, but without success. here is my config:

Nope, it wasn't, we opted to do something much more ambitious, and that
didn't fit the 3.4 timeframe. (So much to do, so little time :/)

There's still the feature/3.3/mongodb/datetime branch in my git repo[1],
and the new thing that will come in 3.5 is on the
feature/3.5/templates/cast-typehints branch. That 3.5 branch is pretty
much current 3.4, so should be fairly safe to use.

The former has the datetime("some.field.name") syntax, the latter has:

 value-pairs(pair("DATE", datetime("$UNIXTIME")))

(Similarly, you can mark stuff as int() or boolean() too)

-- 
|8]



More information about the syslog-ng mailing list