Decorated actions and log line consumption

[Joshua Chia]

The Language Reference has an example decorator called syslog. It is used to extract the timestamp string from the beginning of each log line.

So, conceptually syslog takes care of the timestamp at the start of the line and other patterns take care of the rest of the line, good for separation of concerns, readability, performance and what not.

Except I found that there is actually no "separation of concern". In the action being decorated, it is still possible to match the timestamp string at the start of the line that was already matched by the syslog decorator. For separation of concern, I would like the patterns inside the decorated action to see the line as starting after whatever was matched by syslog. 'next' does not do this. Is it possible to make the patterns inside the decorated pattern see only the part of the line after whatever was matched by the decorator?

In essence, I would like something like 'next' that presents to the decorated actions a suffix of the original line that starts right after whatever is matched by the decorator.

Josh

[Jamie Wilkinson]

If I remember correctly, the $message variable is set by that decorator.  You're right that there's no separation of concerns, and I remember thinking about implementing what you suggest and I cannot remember why I didn't do that.  So, the whole log line is still available to the implicit match, but you can do an explicit match with, e.g.:

@syslog {

 $message ~= /asdfasdf/ {

 }

}

Seems like a reasonable request to be able to define a greedy decorator that replaces the implicit match with the remaining text if it likes, though.

--
You received this message because you are subscribed to the Google Groups "mtail-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mtail-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mtail-users/84c24285-cda5-40c9-a008-6e4edfb40441n%40googlegroups.com.

[☂Josh Chia (謝任中)]

I see. I can explicitly capture the rest of the line and later match against it. Thanks.

[Jamie Wilkinson]

I'd appreciate a feature request filed though!

[☂Josh Chia (謝任中)]

Done.