[syslog-ng] type hinting / mongodb / TAGS as array

[Gergely Nagy]

Gergely Nagy <algernon at madhouse-project.org> writes:

> "Lucas, Sascha" <Sascha.Lucas at gisa.de> writes:
>
>> I'm again looking for a way to store patterndb classified / tagged
>> events in mongodb. My greatest wish is to store the event tags as an
>> array (list) in mongodb. This would greatly enhance querying for
>> different combinations of tags. ATM TAGS is a string. According to the
>> documentation, there seems no way to "type hint" that tags is an
>> array. Or do I miss something?
>
> There is currently no way to do that. I have a work-in-progress
> branch[1] to address that in a fairly crude manner, but it only works
> for $(format-json) at the moment. It should be fairly easy to take that
> branch forward and add MongoDB support too. I may do that later today,
> but I only have resources to prepare a proof of concept patch, can't
> clean it up and submit it properly.
>
>  [1]: https://github.com/algernon/syslog-ng/tree/f/3.6/type-hint/list

I just updated the patch[1], and with that, MongoDB supports things like
this:

 destination d_mongo_tagged {
  mongodb(database("algernon") collection("devel")
          value-pairs(key(MESSAGE)
                      pair("TAGS" list("${TAGS}"))));
 };

Resulting in something like this:

> db.devel.find()
{ "_id" : ObjectId("541bd0122149cd40ff95a6fe"),
  "tags" : [  ".source.#anon-source0" ],
  "MESSAGE" : "seq: 0000000000, thread: 0000, runid: 1411108882, ..." }

[1]: https://github.com/algernon/syslog-ng/commit/611c4e7aba6c7814be0dc2d96332a77451b7d949.patch

-- 
|8]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 818 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20140919/dee81e95/attachment.pgp