Re: [lumberjack] New Syntax Spec and updated Field list
On Mon, 23 Apr 2012, William Heinbockel wrote:
On Thu, Apr 19, 2012 at 7:40 PM, <david(a)lang.hm> wrote:
> On Thu, 19 Apr 2012, William Heinbockel wrote:
>
>> Folks,
>>
>> I'm prepping the CEE 1.0beta release and as part of that, I've tried
>> to summarize some of the discussions surrounding the field naming and
>> syntaxes. The plan for CEE to basically adopt this Lumberjack syntax.
>>
>> An update field list, based on David's suggestions and borrowing from
>> Syslog & libumberlog, is posted here:
>> https://fedorahosted.org/lumberjack/wiki/FieldList#UnifiedFieldList
>
>
> Overall this looks good. The only quibble I have is where you talk about
> Objects and Names. This implies that any hierarchy that exists is only two
> levels deep (object!name), and I don't see a good reason to limit it that
> way.
>
That was not my intention. I will update the wording and add some
additional examples that show how multiple layers work.
I.e., "foo!bar!obj!field" -->
"foo":{"bar":{"obj":{"field":...}}} or
<foo><bar><obj><field>...</field></obj></bar></foo>
That said, I think we should limit the depth to 2 (or maybe 3) for all
of our fields. Of course, we have no control over the depth of the
**native** field contents.
I agree that 2-3 layers is probably a good place to target, but there will
be cases where more make sense (and as you say, in the native structure it
could be really messy)
2 layers is probably a reasonable default to think of using.
David Lang