{"action":"created","issue":{"url":"https://api.github.com/repos/rsyslog/liblognorm/issues/154","labels_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/154/labels{/name}","comments_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/154/comments","events_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/154/events","html_url":"https://github.com/rsyslog/liblognorm/issues/154","id":108101406,"number":154,"title":"Compatibility with grok rules","user":{"login":"radu-gheorghe","id":1482088,"avatar_url":"https://avatars.githubusercontent.com/u/1482088?v=3","gravatar_id":"","url":"https://api.github.com/users/radu-gheorghe","html_url":"https://github.com/radu-gheorghe","followers_url":"https://api.github.com/users/radu-gheorghe/followers","following_url":"https://api.github.com/users/radu-gheorghe/following{/other_user}","gists_url":"https://api.github.com/users/radu-gheorghe/gists{/gist_id}","starred_url":"https://api.github.com/users/radu-gheorghe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radu-gheorghe/subscriptions","organizations_url":"https://api.github.com/users/radu-gheorghe/orgs","repos_url":"https://api.github.com/users/radu-gheorghe/repos","events_url":"https://api.github.com/users/radu-gheorghe/events{/privacy}","received_events_url":"https://api.github.com/users/radu-gheorghe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-24T10:21:48Z","updated_at":"2015-11-26T02:20:55Z","closed_at":null,"body":"I was wondering if it's technically possible to have a converter that would translate grok rules and dictionaries to their liblognorm equivalent. At least for the known stuff like IPs, word=NOTSPACE, etc. Or better still, have liblognorm read grok rules and interpret them as native stuff.\r\n\r\nI think there's some manual work needed to make equivalent types to those grok rules that are built on raw regular expressions, but for the rest it should be doable. Though the end result might be too messy and unmaintainable.\r\n\r\nSo maybe it just makes sense to go through all the rules and dictionaries, pull out the regexes and then just have liblognorm use those regular expressions. Sure, it will be a lot slower than using native rules, but it would allow someone to re-use stuff already on the Internet. And maybe convert to native rules later on *if* performance becomes an issue."},"comment":{"url":"https://api.github.com/repos/rsyslog/liblognorm/issues/comments/159784072","html_url":"https://github.com/rsyslog/liblognorm/issues/154#issuecomment-159784072","issue_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/154","id":159784072,"user":{"login":"chenryn","id":1219655,"avatar_url":"https://avatars.githubusercontent.com/u/1219655?v=3","gravatar_id":"","url":"https://api.github.com/users/chenryn","html_url":"https://github.com/chenryn","followers_url":"https://api.github.com/users/chenryn/followers","following_url":"https://api.github.com/users/chenryn/following{/other_user}","gists_url":"https://api.github.com/users/chenryn/gists{/gist_id}","starred_url":"https://api.github.com/users/chenryn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chenryn/subscriptions","organizations_url":"https://api.github.com/users/chenryn/orgs","repos_url":"https://api.github.com/users/chenryn/repos","events_url":"https://api.github.com/users/chenryn/events{/privacy}","received_events_url":"https://api.github.com/users/chenryn/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T02:20:55Z","updated_at":"2015-11-26T02:20:55Z","body":"There isn't a exists libgrok rpm in EPEL, need to rpmbuild by myself, so I didn't send PR to rsyslog directly. But I can send PR anytime if you like.\r\n\r\nHaven't do a performance benchmask, maybe later."}}