search

rsyslog / liblognorm

a fast samples-based log normalization library
http://www.liblognorm.com
GNU Lesser General Public License v2.1
99 stars 64 forks source link

Output csv without quotes #336

Open rjcortese opened 4 years ago

rjcortese commented 4 years ago

Hey all, thanks for the great library / tool. I'm converting some logs to CSV format with a command like: lognormalizer -r myRulebase -p -e csv -E "field field2 field3 ..." Current output looks like: "field","field2","field3" Everything is peachy but I'm wanting my output to be without quotes: field,field2,field3,... Is there currently a way to do this? If not would it make sense to add this as an enhancement? Thanks again!

davidelang commented 4 years ago

currently everything liblognorm outputs is quoted, it would be a useful thing to add for some use cases, but the primary use case is rsyslog, which is just fine having everything as a string.

So while I think it's a useful option to have, I think it's going to require someone submitting a patch as a contributer (or sponsoring the feature) rather than waiting for the core developers to add it.

David Lang

rjcortese commented 4 years ago

I'm down to give it a shot. If one were to add an option for it, what kind would you suggest? A new command line argument like maybe --csv-no-quotes, or an addition to a current argument?

davidelang commented 4 years ago

On Fri, 27 Mar 2020, R James Cortese wrote:

I'm down to give it a shot. If one were to add an option for it, what kind would you suggest? A new command line argument like maybe --csv-no-quotes, or an addition to a current argument?

is this something that is being added to the liblognorm library? or just to the lognormalize program that uses the library?

I can see two options

  1. just do it in the csv output routine, have an option to have it not quote a field if there is no comma or quote in the field.

  2. have an option in the liblognorm syntax to give an option to say that a number field should end up in the json tree as a number, not as a string. this would be an extra parameter in each data type that results in a number.

David Lang

(adding Rainer directly in case he can notice this and comment amoung his Wu Flu work)

rjcortese commented 4 years ago

I was thinking of just doing it for the lognormalizer program like what is described in 1. above.