[Lognorm] Tokenized-multivalue field-type for liblognorm
singh.janmejay
singh.janmejay at gmail.com
Thu Oct 30 12:03:01 CET 2014
Hi,
This patch-set introduces a log-norm field-type called tokenized, which
allows parsing of token-separated values.
A lot of applications such as nginx write fields in logs that are
comma+space separated etc. For instance, nginx upstream_addrs field writes
comma-separated ip+port combinations to access logs.
Parsing such logs takes significant amount of regex and exec-template work
and leads to rather ugly solution for something as simple as tokenized
string.
With this patch, parsing a list of ip-addresses separated by ', '(comma +
space) for instance, would require a rule similar to:
rule=ips:%my_ips:tokenized:, :ipv4%
This requires a small patch to libestr as well, so this mail has 3 patches
attached.
libestr patch:
0001-Changed-some-functions-that-don-t-modify-their-arg-t.patch
liblognorm patch:
0001-Moved-from-parser-receving-data-as-escaped-string-to.patch
0002-added-support-for-field_type-tokenized-which-parses-.patch
Patches go in order of prefix-number.
--
Regards,
Janmejay
http://codehunk.wordpress.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-added-support-for-field_type-tokenized-which-parses-.patch
Type: text/x-patch
Size: 9316 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Changed-some-functions-that-don-t-modify-their-arg-t.patch
Type: text/x-patch
Size: 3202 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Moved-from-parser-receving-data-as-escaped-string-to.patch
Type: text/x-patch
Size: 8336 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20141030/a2fd5d8e/attachment-0005.bin>
More information about the Lognorm
mailing list