> It probably is. I had hoped to have a final extensible format available now, > but then we had some issues finding consensus on how tags look in CEE, and > this held me. And now some expected and unexpected big bunch of work got into > my way :(
Yep, I understand how that can happen. I guess, from a
practical stand point, is to start using it and see how things evolve
from there. I was just curious, but it sounds like a lot is on your
plate already.
> "prefix" is optional. If you don't need it, just don't specify it. I
> introduced prefix to support using the same rule base with different, well,
> prefixes ;) For example, in rsyslog I have the raw message and the parsed MSG
> part of it. If you run the normalizer on the raw message, you need a common
> prefix to cover, tag, date, ... If you parse the MSG part that prefix is not
> present. So the core idea is to write the rules for the common format and add
> different prefixes as required (or not provide a prefix at all).
Okay.. Got it. Thanks for the information.
--
Champ Clark III | Softwink, Inc | 800-538-9357 x 101
http://www.softwink.com
GPG Key ID: 58A2A58F
Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F
If it wasn't for C, we'd be using BASI, PASAL and OBOL.
pgpKjrxSwKIkS.pgp
Description: PGP signature
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
