[systemd-devel] Looking for experiences formalizing an API for journal messages

[Anne Mulhern]

----- Original Message -----
> From: "Lennart Poettering" <lennart at poettering.net>
> To: "Anne Mulhern" <amulhern at redhat.com>
> Cc: systemd-devel at lists.freedesktop.org
> Sent: Thursday, July 23, 2015 9:21:44 AM
> Subject: Re: [systemd-devel] Looking for experiences formalizing an API for journal messages
> 
> On Thu, 23.07.15 09:17, Anne Mulhern (amulhern at redhat.com) wrote:
> 
> > Hi!
> > 
> > We all know that using the journald native API it is possible to enrich the
> > log
> > entry data w/ key/value pairs, although this facility is Linux only.
> > The set of key/value pairs which a message may log to the journal can
> > constitute an API with which a logging entity can communicate alerts to
> > consumers
> > of this information. Clearly this requires an agreement on an API between
> > the logging
> > entity and the consumer of the journal entries.
> > 
> > Are there existing projects that have used this facility in a principled,
> > coordinated way with some success or have there been any interesting
> > failures
> > along those same lines?
> 
> systemd of courses uses its on its own, and we tried to document
> the fields we use in systemd.journal-fields(7), though it might be
> slightly incomplete.
> 
> But yes, this is indeed API, and deserves complete documentation, like
> any C API, any D-Bus API or a any REST API would need too.
> 
> Lennart
> 
> --
> Lennart Poettering, Red Hat
> 

What I'm wondering about is the existence of some processes (not systemd), that have an
agreement on a set of key-value pairs that they communicate with through the journal.

It seems like, even though there is a mechanism for adding additional key/value pairs,
regular expression matching is still kind of the norm.

I was hoping for an inspiring counter example that uses mostly or exclusively key/value
pairs instead of expression matching, and maybe some hints as to best practices.

- mulhern