That newfangled Journal thing

Posted Nov 22, 2011 0:09 UTC (Tue) by alankila (guest, #47141)
In reply to: That newfangled Journal thing by k8to
Parent article: That newfangled Journal thing

Just because not every place needs structured logging doesn't mean that nobody needs it. And those places that do need it do benefit from journal format that can handle it and provide search facilities on top of it.

The *potential* to generate and find structured messages easily is valuable. There are immediate use cases, from usage statistics on services to automatically showing latest messages from log if daemon fails to start---it's not just more work for programmers for no good reason.

We wrote something like this at work because we needed structured log stream: events our users did, and variable messagetype-specific metadata attached to every log message. It made life simpler for programmers, helpdesk and the beancounters. From this, I would predict: the people who want structured messages are probably more than willing to peek into code to add them, because the alternative is continuing the current regex parsing regime, which is inelegant and error prone.

to post comments

That newfangled Journal thing

Posted Nov 22, 2011 6:53 UTC (Tue) by k8to (guest, #15413) [Link] (2 responses)

You're talking about the case of the logging application producing messages with some kind of internal structure.

I'm talking about structure imposed by the logging interface.

It's a crucial difference. With text stream logging you can easily produce structured messages as needed by the application, whether it's simple and easily readable key-value pairs, or more elaborate and designed-for-program consumption formats like JSON or (ick) XML. Text stream logging lets you do this, it doesn't impose the limitation.

With a structured interface, you're locked into what that interface provides, and cannot grow beyond it or handle things it did not anticipate.

It's a classic case of trying to apply structure from the wrong side.

That newfangled Journal thing

Posted Nov 24, 2011 16:28 UTC (Thu) by alankila (guest, #47141) [Link] (1 responses)

I disagree & find the entire argument bizarre.

The proposed format is key-value storage. Any value can be your "text stream", thereby showing that the new approach is a superset of the old one.

That newfangled Journal thing

Posted Nov 24, 2011 19:45 UTC (Thu) by k8to (guest, #15413) [Link]

And if you need to create nested enclosures that open and close?

A single blob of text inside an enclosure is not a stream.