[Lognorm] liblognorm API changes

[Rainer Gerhards]

> -----Original Message-----
> From: lognorm-bounces at lists.adiscon.com [mailto:lognorm-
> bounces at lists.adiscon.com] On Behalf Of Champ Clark III
> Sent: Wednesday, August 29, 2012 6:35 PM
> To: lognorm at lists.adiscon.com
> Subject: Re: [Lognorm] liblognorm API changes
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Okay.  I think I understand now.  So rather than libee handing back
> the element,  liblognorm will return JSON back.  So,  software like
> Sagan, will need to use json-c to parse and extract the value(s) it
> needs from the returned liblognorm JSON string.  Correct?

Not 100% ;). It would not return a JSON *string* but rather a json-c "struct json_object*" ptr, which you can access via the json-c API. So you do not need to re-parse it with json-c.

> The only issue I have is that the current API makes it extremely
> simple to pull the values needed.  The json-c stuff will add some
> extra overhead (granted,  not very much at all).

Anyway, I'll verify that I do not add extra complexity. I have not yet had a deep look at the changes. My impression was that the change would probably require one third *less* API calls to extract the data (that is what happens in rsyslog v7 when I access json-c objects vs. libee events). If that's not the case, I'll probably wrap the old API (assuming that the additional layer does not cause considerable overhead). That would also solve a couple of other issues I see within the whole subsystem (but I usually prefer to get along without additional wrapper layers).

Thanks again for the good thoughts and pls let them continue to flow!

Rainer
> Think of it this way..  I'm using liblognorm to "parse" and "extract"
> values out of a syslog line.  Now,  I need to "parse" and "extract"
> values of that syslog line information from a JSON format :)
> 
> However,  it's really not a big deal either way.  If it'll improve the
> liblognorm and make it more useable for more people,  then I'm all for
> it.
> 
> 
> - --
> - - Champ Clark III (cclark at quadrantsec.com)
>   Quadrant Information Security (http://quadrantsec.com)
>   Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A
>   GPG Key ID: 0381878A
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
> 
> iQEcBAEBAgAGBQJQPkS4AAoJENnmXt7Lmc3KdAUH/0gVilpH52AxTP7EitUlk7I+
> kYUE9pVAbldZJwClmZiZbfr0yWjXf0MxZFUWxqK2ai+jd1oaEKwpWsHkYYyXYtVg
> ZIRBhRS79zUcRhYNplF9ZLBGvVvX95DRcfcKHt8Hnafv1ZzEpqGiOL1GMBfOadha
> N4i7xeQ+fPFqeJQwnEcgJv+HPSJVhA+9auHTJ3uNWel6eV41umiZXKAKsLl68wbl
> eqEDUgw/U++TqwP7wYLTzF0IIHwPPzL/8oo+VklMcv1t/pJZs4r5SQpTSHt4+V5K
> Ztmj8gxLS1rdjf9aD2RZvwNDR672LXE7bvRDYLItsPCwp693YUghvVR3Iz5oyZM=
> =Xos6
> -----END PGP SIGNATURE-----
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm