They should be paying attention to the lumberjack project

Posted Apr 13, 2012 23:33 UTC (Fri) by ebiederm (subscriber, #35028)
In reply to: They should be paying attention to the lumberjack project by dlang
Parent article: Toward more reliable logging

What is wrong with structured format in RFC5424?

Call me dense but it looks to me like the problem of structured logging have already solved and standardized.

They should be paying attention to the lumberjack project

Posted Apr 14, 2012 1:08 UTC (Sat) by dlang (guest, #313) [Link] (4 responses)

RFC5424 lets you do flat name/value pairs, but it turns out that it's extremely valuable to be able to have more structure than that. Thus the move to JSON

They should be paying attention to the lumberjack project

Posted Apr 16, 2012 6:21 UTC (Mon) by quotemstr (subscriber, #45331) [Link] (3 responses)

> RFC5424 lets you do flat name/value pairs, but it turns out that it's extremely valuable to be able to have more structure than that.

Having more structure than that adds too much complexity to be worthwhile. You can approximate structure using keys.with.dots or numbers --- e.g., filename1=foo filename2=bar. Hierarchy adds far more complexity to makes indexing and browsing, very common cases, than it adds to the very rare log message with repeated units.

Can you give me an example of a situation in which hierarchical logging is clearly better than key-value pairs?

They should be paying attention to the lumberjack project

Posted Apr 16, 2012 6:30 UTC (Mon) by Cyberax (✭ supporter ✭, #52523) [Link]

Flattening hierarchy is extremely easy. So why not do it if you want?

And I don't really see how hierarchical data makes logging more complex. If you don't care about it, then simply ignore it.

They should be paying attention to the lumberjack project

Posted Apr 17, 2012 16:34 UTC (Tue) by k8to (guest, #15413) [Link] (1 responses)

It's really hard to describe transactions with simple keyval pairs.

They should be paying attention to the lumberjack project

Posted Apr 17, 2012 16:36 UTC (Tue) by quotemstr (subscriber, #45331) [Link]

Can you give me a concrete example?

They should be paying attention to the lumberjack project

Posted Apr 14, 2012 23:27 UTC (Sat) by dlang (guest, #313) [Link]

For what it's worth, Rainer Gerhards (the author of RFC5424) is a participant in both the lumberjack project, and the CEE standardization project (http://cee.mitre.org/ working to standardize log messages)