> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of RB > Sent: Friday, June 18, 2010 3:41 PM > To: rsyslog-users > Subject: Re: [rsyslog] feedback requested: NEW rsyslog.conf format > > On Thu, Jun 17, 2010 at 23:48, Rainer Gerhards > <[email protected]> wrote: > > One thing that you (RB) brought up is very interesting: the ability > to parse > > a message multiple times. Would that actually be useful? So far, I > have > > worked on the assumption that a message will be parsed exactly once, > thinking > > that the parser is bound to a device-specific format (and all > messages from > > the same device have the same format). Note that even today it is > possible to > > MODIFY messages after they are parsed. Message modification modules > do that. > > However, there currently does not exist any such module. I had no > need to > > create one and as it looks nobody else had ;) > > At that level, perhaps not. I was thinking of the SQL v. long-term > storage use case again. For long-term storage you'd want as raw a > copy of the message as possible, but for SQL you would want to make > sure it didn't have any injection and was properly escaped, perhaps > only even having a subset of the information. Those uses, however, > don't seem to belong in front-end parsing. I could see someone > wanting to do it, but also shrugging once they figure out it can't be > done and doing it the right way.
If I am don't missing a point, you can already do this with the output templates. At least this was the reason why templates were introduced. E.g. $template rawArch, "%rawmsg%\n" for the long-term storage action and the default database template for the db access. Any concerns with that? Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
