journal minor updates (#16267)
min updates
Costa Tsaousis committed
Oct 24, 2023 at 15:49 UTC
da90a1c713777b0ca9d7c1d78c90f6c45c830cb4
2 files changed
+27
-20
collectors/systemd-journal.plugin/README.md
+5
@@ -237,6 +237,11 @@ Full text search is combined with the selected filters.
237
The text box accepts asterisks `*` as wildcards. So, `a*b*c` means match anything that contains `a`, then `b` and
238
then `c` with anything between them.
239
240
+Spaces are treated as OR expressions. So that `a*b c*d` means `a*b OR c*d`.
241
+
242
+Negative expressions are supported, by prefixing any string with `!`. Example: `!systemd *` means match anything that
243
+does not contain `systemd` on any of its fields.
244
+
245
## Query performance
246
247
Journal files are designed to be accessed by multiple readers and one writer, concurrently.
collectors/systemd-journal.plugin/systemd-journal.c
+22
-20
@@ -2087,8 +2087,10 @@ static void netdata_systemd_journal_dynamic_row_id(FACETS *facets __maybe_unused
2087
2088
buffer_flush(rkv->wb);
2089
2090
- if(!identifier)
2090
+ if(!identifier || !*identifier)
2091
buffer_strcat(rkv->wb, FACET_VALUE_UNSET);
2092
+ else if(!pid || !*pid)
2093
+ buffer_sprintf(rkv->wb, "%s", identifier);
2094
else
2095
buffer_sprintf(rkv->wb, "%s[%s]", identifier, pid);
2096
@@ -2210,10 +2212,10 @@ static void function_systemd_journal(const char *transaction, char *function, in
2212
facets_register_row_severity(facets, syslog_priority_to_facet_severity, NULL);
2213
2214
facets_register_key_name(facets, "_HOSTNAME",
2213
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_VISIBLE | FACET_KEY_OPTION_FTS);
2215
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_VISIBLE);
2216
2217
facets_register_dynamic_key_name(facets, JOURNAL_KEY_ND_JOURNAL_PROCESS,
2216
- FACET_KEY_OPTION_NEVER_FACET | FACET_KEY_OPTION_VISIBLE | FACET_KEY_OPTION_FTS,
2218
+ FACET_KEY_OPTION_NEVER_FACET | FACET_KEY_OPTION_VISIBLE,
2219
netdata_systemd_journal_dynamic_row_id, NULL);
2220
2221
facets_register_key_name(facets, "MESSAGE",
@@ -2226,71 +2228,71 @@ static void function_systemd_journal(const char *transaction, char *function, in
2228
// netdata_systemd_journal_rich_message, NULL);
2229
2230
facets_register_key_name_transformation(facets, "PRIORITY",
2229
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2231
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2232
netdata_systemd_journal_transform_priority, NULL);
2233
2234
facets_register_key_name_transformation(facets, "SYSLOG_FACILITY",
2233
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2235
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2236
netdata_systemd_journal_transform_syslog_facility, NULL);
2237
2238
facets_register_key_name_transformation(facets, "ERRNO",
2237
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2239
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2240
netdata_systemd_journal_transform_errno, NULL);
2241
2242
facets_register_key_name(facets, JOURNAL_KEY_ND_JOURNAL_FILE,
2243
FACET_KEY_OPTION_NEVER_FACET);
2244
2245
facets_register_key_name(facets, "SYSLOG_IDENTIFIER",
2244
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS);
2246
+ FACET_KEY_OPTION_FACET);
2247
2248
facets_register_key_name(facets, "UNIT",
2247
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS);
2249
+ FACET_KEY_OPTION_FACET);
2250
2251
facets_register_key_name(facets, "USER_UNIT",
2250
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS);
2252
+ FACET_KEY_OPTION_FACET);
2253
2254
facets_register_key_name_transformation(facets, "_BOOT_ID",
2253
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2255
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2256
netdata_systemd_journal_transform_boot_id, NULL);
2257
2258
facets_register_key_name_transformation(facets, "_SYSTEMD_OWNER_UID",
2257
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2259
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2260
netdata_systemd_journal_transform_uid, NULL);
2261
2262
facets_register_key_name_transformation(facets, "_UID",
2261
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2263
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2264
netdata_systemd_journal_transform_uid, NULL);
2265
2266
facets_register_key_name_transformation(facets, "OBJECT_SYSTEMD_OWNER_UID",
2265
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2267
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2268
netdata_systemd_journal_transform_uid, NULL);
2269
2270
facets_register_key_name_transformation(facets, "OBJECT_UID",
2269
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2271
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2272
netdata_systemd_journal_transform_uid, NULL);
2273
2274
facets_register_key_name_transformation(facets, "_GID",
2273
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2275
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2276
netdata_systemd_journal_transform_gid, NULL);
2277
2278
facets_register_key_name_transformation(facets, "OBJECT_GID",
2277
- FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2279
+ FACET_KEY_OPTION_FACET | FACET_KEY_OPTION_TRANSFORM_VIEW,
2280
netdata_systemd_journal_transform_gid, NULL);
2281
2282
facets_register_key_name_transformation(facets, "_CAP_EFFECTIVE",
2281
- FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2283
+ FACET_KEY_OPTION_TRANSFORM_VIEW,
2284
netdata_systemd_journal_transform_cap_effective, NULL);
2285
2286
facets_register_key_name_transformation(facets, "_AUDIT_LOGINUID",
2285
- FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2287
+ FACET_KEY_OPTION_TRANSFORM_VIEW,
2288
netdata_systemd_journal_transform_uid, NULL);
2289
2290
facets_register_key_name_transformation(facets, "OBJECT_AUDIT_LOGINUID",
2289
- FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2291
+ FACET_KEY_OPTION_TRANSFORM_VIEW,
2292
netdata_systemd_journal_transform_uid, NULL);
2293
2294
facets_register_key_name_transformation(facets, "_SOURCE_REALTIME_TIMESTAMP",
2293
- FACET_KEY_OPTION_FTS | FACET_KEY_OPTION_TRANSFORM_VIEW,
2295
+ FACET_KEY_OPTION_TRANSFORM_VIEW,
2296
netdata_systemd_journal_transform_timestamp_usec, NULL);
2297
2298
// ------------------------------------------------------------------------