Mark.Martinec+ (Mark Martinec)
2016-02-12 17:13:56 UTC
Hello,
the attached patch adds a log macro report_json_filtered to amavisd.
This macro is like report_json but will remove all specified fields
from
the output.
$logline_maxlen = ( 32*1024 ) - 50; # 32k max message size, keep 50
bytes for syslog
$log_templ = <<'EOD';
EOD
It may be usefull for filtering unused fields to save diskspace and to
avoid logging of message content (subject, user_agent).
Markus
Responding to a year-old suggestion...the attached patch adds a log macro report_json_filtered to amavisd.
This macro is like report_json but will remove all specified fields
from
the output.
$logline_maxlen = ( 32*1024 ) - 50; # 32k max message size, keep 50
bytes for syslog
$log_templ = <<'EOD';
EOD
It may be usefull for filtering unused fields to save diskspace and to
avoid logging of message content (subject, user_agent).
Markus
The feature will be in the coming 2.11.0. From release notes:
- A log template macro 'report_json' can now take arguments, which can
include or exclude fields (key/values) from the JSON report object.
Arguments to a macro are either field names (keys) to be included
in a report, or are field names to be excluded, each prefixed with
an exclamation mark, to produce a report with all but excluded fields.
Field names are case-sensitive. The order of fields in a serialized
JSON object is unaffected by the order of field names in a filter.
Unknown or non-present field names in a filter are silently ignored.
Example:
[:report_json|mail_id|action|content_type|queued_as|mail_from|size]
or:
[:report_json|!recipients|!elapsed|!os_fp|!subject|!subject_rot13]
For better clarity, instead of listing field names as individual
arguments to a macro, it is also possible to provide a single argument
in which field names are separated by whitespace:
[:report_json|mail_id action content_type queued_as mail_from size]
or:
[:report_json|!message !recipients !to_addr !elapsed !os_fp
!subject !subject_rot13 !user_agent !tests !tests_ham
!tests_spam]
A setting in a config file can look like:
$log_templ = '[:report_json|mail_id action queued_as mail_from]';
If at least one field name has an exclamation mark (i.e. is to be
excluded), all but excluded fields are implied, so any field names
without an exclamation mark are redundant.
Currently this is a simple filter where subfields of a structured
object cannot be selectively filtered (e.g. elapsed.SpamCheck).
Based on a patch by Markus Benning.
Thanks for the suggestion!
Mark