opened
saimon7
username_0
This is implementation of a producer for Graylog.
Add Graylog producer
issue
created
osheroff
username_1
Code looks generally sane.  You may have to watch out for the case where people are running in binlog_row_image=minimal (for updates, we may not end up having both a before-and-after value).  

Could you provide an example of what the output format looks like?  I'm not familiar with the GELF format, but it looks like you're sending a new GELF message for each column?  would it maybe be better to send one message with each column as an additional field like:

``` 
  { ... timestamp, etc
    "_user_id": 553243, 
    "_user_id.old": 422231,
    "_foo_column": "bar"  
   }
```
 (I'm presuming GELF doesn't allow for nested data?)
comment
created
saimon7
username_0
I looked into Graylog documentation about additional fields and checked witch field name can be accepted. The problem is that field name allowed only: letter, number, underscore and also not supported nested field. 
I suppose that the elasticksearch which is used by Graylog can be a problem, but this is only my suspicion.

Example behavior:

| input          | output      | result |
|----------------|-------------|------------
| `column_id`: 12 | `column_id`: 12 | work fine 
| `_column_id`: 12 | `column_id`: 12 | work fine, but remove first sign undersore
| `__column_id`: 12 | `_column_id`: 12 | work, but replace name
| `column.id`: 12 | `_column_id`: 12 | replace name to: column_id 
| `column`: {`id`: 12} | `column`: {`id` : 12} | cann't search by nested field
| `column-id`: 12 | `column-id`: 12 | work fine
| `-column-id`: 12 | `-column-id`: 12 | cann't search by this field, is negate condition

When people running with the "minimalist" case, there is put empty string.


I also forgot to implement primary key (can be composite key) for log, so finally payload will be one send message as you suggested:

<pre>
</code>
{ 
	... timestamp, etc
	"primary_key_one": 1,
        "primary_key_two": 2,
        "column_user_id": 123, 
        "column_foo_column": "bar" 
        "column_old_user_id": 321
}
</code>
</pre>

`"primary_key_{column_name}"`, `"column_{column_name}"`, `"column_old_{column_name}"` must be prefix.
comment
created
osheroff
username_1
man, I gotta stop reviewing PRs and then going traveling.  I think it might be more effective here to just tunnel the data into a string that is then unwrapped, ie:

```
  "data": " { \"id\": 123 } "
```

otherwise there's too much weirdness around crashing field names and such.

@username_2 if I wander away here can you pick up my laziness?
comment
created
liulikun
username_2
Will keep an eye out.
comment