Re: [rsyslog] feedback request on format-changing bugfix

[David Lang]

On Thu, 18 Feb 2016, Rainer Gerhards wrote:


Hi all,

I received a bug fix for impstats that changes the json-based formats
slighly. Please see:

https://github.com/rsyslog/rsyslog/pull/798

Any concerns?


I think we should go ahead and let JSON not have the @cee header. While it could 
break someone's config, it's a small break that's easily fixed (either change 
the type to cee instead of json, or fix their parser to accept json)


Long term, it's far cleaner than making cee and json be the same and then having 
a _no_i_really_mean_json type as well.


If we are going to start down the road of mangling things at this level to 
support elasticsearch, then we will end up adding lots of format variations 
everywere. We really need a sanitize/cleanup that can fixup things to deal with 
those sorts of problems. otherwise we're going to get creeping configs to handle 
the issues all over the place.


David Lang
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] feedback request on format-changing bugfix

[Thomas D.]

Hi,

Rainer Gerhards wrote:
> Any concerns?

Maybe:

Don't we get in conflict with

> • $PStatJSON  (rsyslog v6.3.8+ only) If set to on,
> stats messages are emitted as structured cee-enhanced syslog.
> If set to off, legacy format is used (which is compatible with
> pre v6-rsyslog).

From
http://www.rsyslog.com/doc/master/configuration/modules/impstats.html#legacy-configuration-directives

Unless we also change this behavior (and document that we have changed
it) we should make sure that "cee" is turned on when this legacy option
is set.


-Thomas

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] feedback request on format-changing bugfix

[Radu Gheorghe]

Hi Rainer,

No concerns here, it sounds like the right thing to do. I suppose
scripts working with the CEE cookie already use the CEE option? At
least that was our case (we were parsing with mmjsonparse afterwards).

Best regards,
Radu
--
Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/


On Thu, Feb 18, 2016 at 10:28 AM, Rainer Gerhards
 wrote:
> Hi all,
>
> I received a bug fix for impstats that changes the json-based formats
> slighly. Please see:
>
> https://github.com/rsyslog/rsyslog/pull/798
>
> Any concerns?
>
> Thanks,
> Rainer
> ___
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T 
> LIKE THAT.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] feedback request on format-changing bugfix

[Brian Knox]

None from me.
On Feb 18, 2016 3:28 AM, "Rainer Gerhards"  wrote:

> Hi all,
>
> I received a bug fix for impstats that changes the json-based formats
> slighly. Please see:
>
> https://github.com/rsyslog/rsyslog/pull/798
>
> Any concerns?
>
> Thanks,
> Rainer
> ___
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

[rsyslog] feedback request on format-changing bugfix

[Rainer Gerhards]

Hi all,

I received a bug fix for impstats that changes the json-based formats
slighly. Please see:

https://github.com/rsyslog/rsyslog/pull/798

Any concerns?

Thanks,
Rainer
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.