Needs review
Project:
GELF
Version:
7.x-1.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Reporter:
Created:
8 Feb 2012 at 10:37 UTC
Updated:
25 Oct 2013 at 12:27 UTC
Jump to comment: Most recent file
This would allow searching via variables across messages
| Comment | File | Size | Author |
|---|---|---|---|
| #18 | record_watchdog_variables_in_graylog-1432612-18.patch | 601 bytes | Dean Reilly |
| #13 | add_watchdog_variables-1432612-2.patch | 627 bytes | eli-t |
| #1 | add_watchdog_variables-1432612-1.patch | 557 bytes | eli-t |
Comments
Comment #1
eli-tPatch attached
Comment #2
jeffsheltren commentedThanks, I'll take a look at this patch.
Comment #3
eli-tHey Jeff, any movement on this? We have the patch deployed in production with no issues.
Comment #4
jeffsheltren commentedHi, sorry for the delay. The patch seems OK, but I can see a problem if one of the keys in $entry['variables'] gets set to one of the fields we're already setting (e.g. "Uid" or "Request_uri"), then this would overwrite them.
I suppose one way around this is to do the loop to set variables before we set the "standard" fields. Thoughts?
Comment #5
eli-tFair point! Maybe rather than change the order, check for the "standard" fields when adding the variables and don't set if it's one of the standard fields.
Both ways would work but I think the intent is clearer in the second.
Comment #6
eli-tAdditional thought - when we're adding the additional variables, we're not stripping the !, % or @ prefix from the key, so as long as the user has properly prefixed the additional variables' names we're not going to overwrite any of the previous set keys such as Uid/Request_uri.
Comment #7
jeffsheltren commentedHi Elliot, I think my concerns would be alleviated if we simply move the block setting the additional fields to be above where we set some "default" additional fields.
I'd also like to add a small bit of text to the README explaining the usage of setting these additional fields. Would you mind taking a stab at that and re-rolling the patch?
Comment #8
eli-tWill do! Bit busy for the next couple of weeks so will be after that
Comment #9
rurri commentedWhy not allow these variables to override the default ones? Doing it this way allows for me to force/override some of the default variables.
Comment #10
eli-tThat's a good point @rurri... how do you feel about that @JeffSheltren?
Comment #11
jeffsheltren commentedIf we're going to allow overriding of stuff like "server host", etc., then I'd rather see that done as part of the admin configuration. Allowing calling modules to overwrite these variables seems like we're opening ourselves up to some potential bad coding mistakes. I'd rather see the GELF module set some standard "additional" fields, and then allow users to add their own custom fields as desired.
Do you have some strong need to override some of the variables as it is currently?
Comment #12
eli-tI don't. Unless @rurri has a good case he wants to put forward, I'll go with the module maintainer's preference.
Comment #13
eli-tPatch amended as referenced in #7 and rerolled against latest dev
Comment #14
MarcElbichon commentedVariables in watchdog can be used as placeholders for message. So they don't have to be added to gelf structure.
Why not to add a special variable in $variable array ?
Comment #15
eli-tDo you mean when calling watchdog()? The solution I've proposed is designed so that all existing calls in core/contrib will also pass through gelf variables automatically, rather than all modules having to change to pass gelf variables.
Comment #16
MarcElbichon commentedYes but $variable is used for placeholders like (from user.module)
Do you want to add an new field "%user" to Graylog ? I'm not sure.
So, if think this is better to add a new var with all desired graylog's fields like this
So only myfield will be added to graylog.
Comment #17
eli-tActually, my intention *is* to add all watchdog variables automatically as gelf properties.
Comment #18
Dean Reilly commentedI think a better way to handle the watchdog variables is to prefix the key with something (wv_ for example) so that they don't collide with the additional parameters we're setting manually. Just placing the block at the top means we'll never record the values that do clash and that seems like a bad thing.
I've attached a new patch with the proposed change for D7.