[systemd-devel] sd_journal_add_match if not using the form of "FIELD=value"

[Chris Morgan]

On Mon, Mar 9, 2015 at 1:44 AM, Mantas Mikulėnas <grawity at gmail.com> wrote:
> On Mon, Mar 9, 2015 at 12:53 AM, Lennart Poettering <lennart at poettering.net>
> wrote:
>>
>> On Fri, 06.03.15 21:28, Chris Morgan (chmorgan at gmail.com) wrote:
>>
>> >
>> > http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html
>> > is pretty clear that the matches are in the form of 'FIELD=value' but
>> > it doesn't mention the why.
>> >
>> > What if I've written a field like "FIELD", can I then match on it as
>> > "FIELD"?
>>
>> Hmm, not sure I understand what you mean?
>>
>> The journal stores key/value pairs, on display and when parsing we
>> denote them in the form of an uppercase fied name, followed by a "=",
>> followed by any kind of data.
>>
>> Hence, just "FIELD" is not something the journald would or could
>> store. If you try to pass this to journald for it to write, it would
>> drop this, because it's malformed and not a key/value pair.
>
>
> I think the idea was just to *match* all entries that have a given key
> *present* but with any value?
>

Correct.

Otherwise I need to insert yet another tag like "SOME_IDENTIFIER=1"
that is present in all of my entries in order to be able to use that
interface to efficiently look up journal entries.

Chris