Re: [systemd-devel] sd_journal_add_match if not using the form of FIELD=value
On Mon, 09.03.15 07:44, Mantas Mikulėnas (graw...@gmail.com) wrote: On Mon, Mar 9, 2015 at 12:53 AM, Lennart Poettering lenn...@poettering.net wrote: On Fri, 06.03.15 21:28, Chris Morgan (chmor...@gmail.com) wrote: http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html is pretty clear that the matches are in the form of 'FIELD=value' but it doesn't mention the why. What if I've written a field like FIELD, can I then match on it as FIELD? Hmm, not sure I understand what you mean? The journal stores key/value pairs, on display and when parsing we denote them in the form of an uppercase fied name, followed by a =, followed by any kind of data. Hence, just FIELD is not something the journald would or could store. If you try to pass this to journald for it to write, it would drop this, because it's malformed and not a key/value pair. I think the idea was just to *match* all entries that have a given key *present* but with any value? The database does not make look-ups like this efficient, it's not indexed for that. You can build this by combining sd_journal_query_unique() and then use the field/value pairs this fine to find the entries. But this is not efficient. Lennart -- Lennart Poettering, Red Hat ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] sd_journal_add_match if not using the form of FIELD=value
On Mon, Mar 9, 2015 at 1:44 AM, Mantas Mikulėnas graw...@gmail.com wrote: On Mon, Mar 9, 2015 at 12:53 AM, Lennart Poettering lenn...@poettering.net wrote: On Fri, 06.03.15 21:28, Chris Morgan (chmor...@gmail.com) wrote: http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html is pretty clear that the matches are in the form of 'FIELD=value' but it doesn't mention the why. What if I've written a field like FIELD, can I then match on it as FIELD? Hmm, not sure I understand what you mean? The journal stores key/value pairs, on display and when parsing we denote them in the form of an uppercase fied name, followed by a =, followed by any kind of data. Hence, just FIELD is not something the journald would or could store. If you try to pass this to journald for it to write, it would drop this, because it's malformed and not a key/value pair. I think the idea was just to *match* all entries that have a given key *present* but with any value? Correct. Otherwise I need to insert yet another tag like SOME_IDENTIFIER=1 that is present in all of my entries in order to be able to use that interface to efficiently look up journal entries. Chris ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
Re: [systemd-devel] sd_journal_add_match if not using the form of FIELD=value
On Fri, 06.03.15 21:28, Chris Morgan (chmor...@gmail.com) wrote: http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html is pretty clear that the matches are in the form of 'FIELD=value' but it doesn't mention the why. What if I've written a field like FIELD, can I then match on it as FIELD? Hmm, not sure I understand what you mean? The journal stores key/value pairs, on display and when parsing we denote them in the form of an uppercase fied name, followed by a =, followed by any kind of data. Hence, just FIELD is not something the journald would or could store. If you try to pass this to journald for it to write, it would drop this, because it's malformed and not a key/value pair. I presume that sd_journal_add_match is doing an identical value match that would preclude searching for FIELD=value using just FIELD? The matches check fields against values. That's all, really. Lennart -- Lennart Poettering, Red Hat ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
[systemd-devel] sd_journal_add_match if not using the form of FIELD=value
http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html is pretty clear that the matches are in the form of 'FIELD=value' but it doesn't mention the why. What if I've written a field like FIELD, can I then match on it as FIELD? I presume that sd_journal_add_match is doing an identical value match that would preclude searching for FIELD=value using just FIELD? Chris ___ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel
