boyska/circolog
1
2
Fork 1
Code Issues 6 Pull requests 1 Releases Wiki Activity

filtering explained in README.md

Browse source
This commit is contained in:
boyska 2018-12-26 02:21:15 +01:00
parent 5db7e2f01b
commit 6f63873591
1 changed files with 28 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
README.md
View file

@ -72,10 +72,10 @@ Pausing might be the easiest way to make circologd only run "when needed".
When circologd resumes, no previous message is lost. When circologd resumes, no previous message is lost.
To pause/unpause:
To pause circologd with signals , send a `USR1` signal to the main pid. To "resume", send a `USR1` again. * `circologctl pause`
* `pkill -USR1 circologd`
To pause with HTTP, send a `POST /pause/toggle` to your circologd control socket. * `POST /pause/toggle` to your circologd control socket
### Clear ### Clear
@ -83,3 +83,27 @@ When you clear the circologd's buffer, it will discard every message it has, but
messages. messages.
You can do that with `POST /logs/clear` You can do that with `POST /logs/clear`
### Filter
circologd can drop irrelevant messages using filters. A filter is a sql-like expression (for the exact syntax
you can see [the doc for the underlying library](https://github.com/araddon/qlbridge/blob/master/FilterQL.md),
qlbridge), but just imitating sql where clauses can be enough!
`circologctl filter message NOT LIKE '%usb%'` will discard everything related to usb.
The filter will be applied to incoming messages, so messages mentioning usb will not be saved in memory at all.
You can put zero or one filters at a time. That is, you can not stack more filters... but FilterQL syntax
supports `AND` operators, so this is not an issue.
To remove filtering (thus accepting every message) run `circologctl filter`
NOTE: `circolog-tail` supports filters with exactly the same syntax, but they are two different kinds of
filtering: one is server-side, the other is client-side. When you filter server-side with `circologctl
filter`, circologd will refuse messages not matching the filter. If you only filter with `circolog-tail`, the
message you are filtering out will still consume space in memory (and will be available to other clients).
Filtering brings big dependencies, which will add some 5-6 megabytes to circolog binaries. If you want to
avoid it, install with `go install -tags nofilter git.lattuga.net/boyska/circolog/...` and your binaries will
be a bit smaller.