[systemd-devel] sd_journal_add_match if not using the form of "FIELD=value"

[Lennart Poettering]

On Mon, 09.03.15 07:44, Mantas Mikulėnas (grawity at gmail.com) wrote:

> On Mon, Mar 9, 2015 at 12:53 AM, Lennart Poettering <lennart at poettering.net>
> wrote:
> 
> > On Fri, 06.03.15 21:28, Chris Morgan (chmorgan at gmail.com) wrote:
> >
> > >
> > http://www.freedesktop.org/software/systemd/man/sd_journal_add_match.html
> > > is pretty clear that the matches are in the form of 'FIELD=value' but
> > > it doesn't mention the why.
> > >
> > > What if I've written a field like "FIELD", can I then match on it as
> > > "FIELD"?
> >
> > Hmm, not sure I understand what you mean?
> >
> > The journal stores key/value pairs, on display and when parsing we
> > denote them in the form of an uppercase fied name, followed by a "=",
> > followed by any kind of data.
> >
> > Hence, just "FIELD" is not something the journald would or could
> > store. If you try to pass this to journald for it to write, it would
> > drop this, because it's malformed and not a key/value pair.
> 
> 
> I think the idea was just to *match* all entries that have a given key
> *present* but with any value?

The database does not make look-ups like this efficient, it's not
indexed for that. 

You can build this by combining sd_journal_query_unique() and then
use the field/value pairs this fine to find the entries. But this is
not efficient.

Lennart

-- 
Lennart Poettering, Red Hat