On Mon, 09.03.15 07:44, Mantas Mikulėnas (graw...@gmail.com) wrote: > On Mon, Mar 9, 2015 at 12:53 AM, Lennart Poettering <lenn...@poettering.net> > wrote: > > > On Fri, 06.03.15 21:28, Chris Morgan (chmor...@gmail.com) wrote: > > > > > > > http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html > > > is pretty clear that the matches are in the form of 'FIELD=value' but > > > it doesn't mention the why. > > > > > > What if I've written a field like "FIELD", can I then match on it as > > > "FIELD"? > > > > Hmm, not sure I understand what you mean? > > > > The journal stores key/value pairs, on display and when parsing we > > denote them in the form of an uppercase fied name, followed by a "=", > > followed by any kind of data. > > > > Hence, just "FIELD" is not something the journald would or could > > store. If you try to pass this to journald for it to write, it would > > drop this, because it's malformed and not a key/value pair. > > > I think the idea was just to *match* all entries that have a given key > *present* but with any value?
The database does not make look-ups like this efficient, it's not indexed for that. You can build this by combining sd_journal_query_unique() and then use the field/value pairs this fine to find the entries. But this is not efficient. Lennart -- Lennart Poettering, Red Hat _______________________________________________ systemd-devel mailing list systemd-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/systemd-devel