On Tue, 30 Apr 2013, Rainer Gerhards wrote:
On Tue, 2013-04-30 at 03:27 -0700, David Lang wrote:
On Tue, 30 Apr 2013, Rainer Gerhards wrote:
I agree that modifying the original message (or worse, a portion of the original
message) and then having to re-parse it to properly update all the derived
variables is extremely ugly.
I think that modifying the MSG part of the message is probably not
problematic. But anything beyond that most probably is...
With just traditional syslog (where the MSG is pure free-form text) you are
right, but we are past that now with JSON, RFC5424, etc. The MSG portion is now
being parsed and the results assigned to variables.
What would you do if you parsed a message, it created a variable that's then
used in an IF statement to do a rewrite of the message that eliminates the
variable that you created?
or what if you have multiple IF statements, the first of which would rewrite the
message in a way that would create a variable that's used by a second IF
statement.
This way lies madness.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
