As an efficiency thing, I would suggest having it get a variable instead of a
templage. You can assign a template to a variable if you need to, but if you
don't (because a prior step already parsed out the data to a variable) you skip
the time needed to go through the template engine.
I expect that most of the time you are going to have the part you want to
normalize as the contents of a variable being passed in via JSON or a structured
data field, not as something that you would need the full power and complexity
of the template string generator to get at.
The template string handler is slower than you would think. When we added the
ability to have string generation modules in C instead of using the template
engine, it made a noticable difference in the total throughput of rsyslog, and
if we are just going to be starting from a string to begin with, running it
through the template engine is pure overhead.
Thanks for doing this sort of thing. I was wanting to get mmnormalize and
mmjsonparse to work on arbitrary strings instead of just $msg, but hadn't had
time to deal with it.
David Lang
On Tue, 14 Oct 2014, singh.janmejay wrote:
Date: Tue, 14 Oct 2014 01:03:44 +0530
From: singh.janmejay <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] Patch to allow choice of templates in mmnormalize
Hi,
As of now mmnormalize supports only raw-msg or msg via the boolean flag
'useRawMsg'. This patch allows using template="template_name" with
mmnormalize just like a few other actions(such as omfwd, omelasticsearch
etc) do.
It expects a param called 'template' following the convention in other
action-types. And when both useRawMsg and template params are set, it
prints a warning that template will be ignored and uses raw-message
instead.
The patch is called 0003... because its the 3rd patch in my local-repo. But
since it doesn't have any files common with previous patches, it should
apply just fine on any recent commit.
Please let me know if the patch looks good for merging, I'll update the
documentation.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
