[Lognorm] Tokenized-multivalue field-type for liblognorm

singh.janmejay singh.janmejay at gmail.com
Thu Oct 30 12:03:01 CET 2014


Hi,

This patch-set introduces a log-norm field-type called tokenized, which
allows parsing of token-separated values.

A lot of applications such as nginx write fields in logs that are
comma+space separated etc. For instance, nginx upstream_addrs field writes
comma-separated ip+port combinations to access logs.

Parsing such logs takes significant amount of regex and exec-template work
and leads to rather ugly solution for something as simple as tokenized
string.

With this patch, parsing a list of ip-addresses separated by ', '(comma +
space) for instance, would require a rule similar to:

rule=ips:%my_ips:tokenized:, :ipv4%

This requires a small patch to libestr as well, so this mail has 3 patches
attached.

libestr patch:

0001-Changed-some-functions-that-don-t-modify-their-arg-t.patch

liblognorm patch:

0001-Moved-from-parser-receving-data-as-escaped-string-to.patch
0002-added-support-for-field_type-tokenized-which-parses-.patch

Patches go in order of prefix-number.

-- 
Regards,
Janmejay
http://codehunk.wordpress.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-added-support-for-field_type-tokenized-which-parses-.patch
Type: text/x-patch
Size: 9316 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Changed-some-functions-that-don-t-modify-their-arg-t.patch
Type: text/x-patch
Size: 3202 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Moved-from-parser-receving-data-as-escaped-string-to.patch
Type: text/x-patch
Size: 8336 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0005.bin>


More information about the Lognorm mailing list