[systemd-devel] sd_journal_add_match if not using the form of "FIELD=value"

[Lennart Poettering]

On Fri, 06.03.15 21:28, Chris Morgan (chmorgan at gmail.com) wrote:

> http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html
> is pretty clear that the matches are in the form of 'FIELD=value' but
> it doesn't mention the why.
> 
> What if I've written a field like "FIELD", can I then match on it as
> "FIELD"?

Hmm, not sure I understand what you mean?

The journal stores key/value pairs, on display and when parsing we
denote them in the form of an uppercase fied name, followed by a "=",
followed by any kind of data.

Hence, just "FIELD" is not something the journald would or could
store. If you try to pass this to journald for it to write, it would
drop this, because it's malformed and not a key/value pair.

> I presume that sd_journal_add_match is doing an identical value match
> that would preclude searching for "FIELD=value" using just "FIELD"?

The matches check fields against values. That's all, really.

Lennart

-- 
Lennart Poettering, Red Hat