[Lognorm] liblognorm API changes

[Champ Clark III]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Okay.  I think I understand now.  So rather than libee handing back
the element,  liblognorm will return JSON back.  So,  software like
Sagan, will need to use json-c to parse and extract the value(s) it
needs from the returned liblognorm JSON string.  Correct?

The only issue I have is that the current API makes it extremely
simple to pull the values needed.  The json-c stuff will add some
extra overhead (granted,  not very much at all).

Think of it this way..  I'm using liblognorm to "parse" and "extract"
values out of a syslog line.  Now,  I need to "parse" and "extract"
values of that syslog line information from a JSON format :)

However,  it's really not a big deal either way.  If it'll improve the
liblognorm and make it more useable for more people,  then I'm all for
it.


- -- 
- - Champ Clark III (cclark at quadrantsec.com)
  Quadrant Information Security (http://quadrantsec.com)
  Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
  GPG Key ID: 0381878A
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQEcBAEBAgAGBQJQPkS4AAoJENnmXt7Lmc3KdAUH/0gVilpH52AxTP7EitUlk7I+
kYUE9pVAbldZJwClmZiZbfr0yWjXf0MxZFUWxqK2ai+jd1oaEKwpWsHkYYyXYtVg
ZIRBhRS79zUcRhYNplF9ZLBGvVvX95DRcfcKHt8Hnafv1ZzEpqGiOL1GMBfOadha
N4i7xeQ+fPFqeJQwnEcgJv+HPSJVhA+9auHTJ3uNWel6eV41umiZXKAKsLl68wbl
eqEDUgw/U++TqwP7wYLTzF0IIHwPPzL/8oo+VklMcv1t/pJZs4r5SQpTSHt4+V5K
Ztmj8gxLS1rdjf9aD2RZvwNDR672LXE7bvRDYLItsPCwp693YUghvVR3Iz5oyZM=
=Xos6
-----END PGP SIGNATURE-----