> The new imuxsock stores "pid", "uid" and "gid" into a "trusted" > subobject; shouldn't they go into the root object by default, so that > the JSON data can be used for Lumberjack storage directly without > modification in a template? (This also implies that mmjsonparse would > have to prevent modification of these values by content of the > message.)
That's actually a good question. I see value in both. And with the flat vs. structured question being discussed again at CEE, I really don't know. Both makes sense. I have to admit (you may remember my presentation) that I have become tired by these discussions and rather code, as many others do (especially those that claim to solve all problems at once...). I don't object if we put them into the root directly, but for other use cases that'sprobably not as good (e.g. for quick access to all trusted properties, which then must be made on a field-by-field basis, what is especially bad from an extensibility PoV. In any case, I plan to make the container configurable. It's easy and leaves the choice to the user. But I had no time so far. Before doing that, I'll have to finish the rule engine/variable setting work. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
