On Thu, Jun 17, 2010 at 23:48, Rainer Gerhards <[email protected]> wrote: > One thing that you (RB) brought up is very interesting: the ability to parse > a message multiple times. Would that actually be useful? So far, I have > worked on the assumption that a message will be parsed exactly once, thinking > that the parser is bound to a device-specific format (and all messages from > the same device have the same format). Note that even today it is possible to > MODIFY messages after they are parsed. Message modification modules do that. > However, there currently does not exist any such module. I had no need to > create one and as it looks nobody else had ;)
At that level, perhaps not. I was thinking of the SQL v. long-term storage use case again. For long-term storage you'd want as raw a copy of the message as possible, but for SQL you would want to make sure it didn't have any injection and was properly escaped, perhaps only even having a subset of the information. Those uses, however, don't seem to belong in front-end parsing. I could see someone wanting to do it, but also shrugging once they figure out it can't be done and doing it the right way. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
