[patch] macro report_json_filtered

[Mark Martinec]

On 2014-12-04 15:30, Markus Benning wrote:
> Hello,
> 
> the attached patch adds a log macro report_json_filtered to amavisd.
> 
> This macro is like report_json but will remove all specified fields 
> from
> the output.
> 
> Example:
> 
> $logline_maxlen = ( 32*1024 ) - 50; # 32k max message size, keep 50
> bytes for syslog
> $log_templ = <<'EOD';
> [:report_json_filtered|@timestamp|subject|subject_rot13|time_iso_week_date|time_unix|digest_body|type|user_agent|partition|originating]
> EOD
> 
> It may be usefull for filtering unused fields to save diskspace and to
> avoid logging of message content (subject, user_agent).
> 
>  Markus

Responding to a year-old suggestion...


The feature will be in the coming 2.11.0. From release notes:


- A log template macro 'report_json' can now take arguments, which can
   include or exclude fields (key/values) from the JSON report object.
   Arguments to a macro are either field names (keys) to be included
   in a report, or are field names to be excluded, each prefixed with
   an exclamation mark, to produce a report with all but excluded fields.

   Field names are case-sensitive. The order of fields in a serialized
   JSON object is unaffected by the order of field names in a filter.
   Unknown or non-present field names in a filter are silently ignored.

   Example:
     [:report_json|mail_id|action|content_type|queued_as|mail_from|size]
   or:
     [:report_json|!recipients|!elapsed|!os_fp|!subject|!subject_rot13]

   For better clarity, instead of listing field names as individual
   arguments to a macro, it is also possible to provide a single argument
   in which field names are separated by whitespace:
     [:report_json|mail_id action content_type queued_as mail_from size]
   or:
     [:report_json|!message !recipients !to_addr !elapsed !os_fp
        !subject !subject_rot13 !user_agent !tests !tests_ham 
!tests_spam]

   A setting in a config file can look like:
     $log_templ = '[:report_json|mail_id action queued_as mail_from]';

   If at least one field name has an exclamation mark (i.e. is to be
   excluded), all but excluded fields are implied, so any field names
   without an exclamation mark are redundant.

   Currently this is a simple filter where subfields of a structured
   object cannot be selectively filtered (e.g. elapsed.SpamCheck).

   Based on a patch by Markus Benning.


Thanks for the suggestion!

   Mark