On Fri, 22 May 2015, singh.janmejay wrote:
On Thu, May 21, 2015 at 11:10 PM, David Lang <[email protected]> wrote:
is foreach the only way to access the elements of an array?
Subscripting arr[0], arr[1] etc can be used to access elements of an
array, but its not useful in this context.
thanks. Just a note that this needs to be added to documentation at some point.
If you do something like
foreach ($.class in $!extracted!event.tags) do {
if $.class == 'trash' then stop
}
/var/log/messages
will messages that have trash as one element in the array still end up being
written out to /var/log/messages?
No, they won't. Wrote a quick test to validate:
https://github.com/rsyslog/rsyslog/pull/356
good.
Is there a better way to check for an element in an array than the
following?
set $.found = 'no';
foreach ($.test in $!something) do {
if $.test = 'value' then set $.found = 'yes';
}
if $.found == 'yes' then {
something
}
I guess we should support json-path(similar to xpath but for json)
based lookup, and predicates?
$.bazes = get("/foo/bar[?]/baz", $!something)
if (contains($.bazes, "do_something")) then {
something
}
Given $! = {"foo" : {"bar": [{"baz" : "abc"}, {"baz":
"do_something"}]}} it'll execute something.
But given $! = {"foo" : {"bar": [{"baz" : "abc"}, {"baz":
"do_nothing"}]}} it'll not.
This is clearly a 2 step thing, but im proposing this as opposed to
single-step predicate for composability reasons.
$.bazes in this case can be useful outside the context of
conditional-actions. $.bazes in first case be a json array of the
form: ["abc", "do_something"]
we already have the keyword 'contains' so we'll need to figure something else.
But I was thinking more along the lines of
given $! = { "extracted" : { "event.tags" : [ "cisco", "auth", "ASA-2-xxxx" ] }
}
if "auth" inarray $!extracted!event.tags then
or we could overload the contains keyword so that if the argument on the left is
a string it does the substring lookup, but if it's an array it does an array
element lookup.
if $!extracted!event.tags[] contains "auth" then
your example of
Given $! = {"foo" : {"bar": [{"baz" : "abc"}, {"baz": "do_something"}]}
is one I'm not sure we should support directly. I see dragons there and I'm not
sure it's anywhere near as common.
however I could see doing the two step dance
$.bazes = extract("/foo/bar[?]/baz")
resulting in
$.bases = [ "abc", "do_something" ]
and then you could do
if $.bazes[] contains "do_something" then
reading back over what you posted, this sounds like it's really close to what
you are proposing.
I would make the difference between a text 'contains' and an array element
'contains' explicit in the config somehow. Either with a different keyword than
'contains' for the array lookup, or with the syntactic [] at the end of the
variable name like I show above.
thoughts?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
