CHANGELIST

1.20110708.*
  - Patch from wxs to clean up some compiler warnings/issues and also
    to have the Makefile obey CC

1.20110630.*
  - Allow patterns to be defined in-line.
      Synopsis: %{NAME=pattern}
      Example: %{NUMBER:foo=\d+}
    This is most useful for defining named-captures in-line for one-offs.
    It was designed for use in logstash, but is certainly appropriate
    elsewhere.

1.20110429.*
  - fix debian packaging problems

1.20110308.*
  - Multiple OSX fixes regarding the different shared library suffix (.dylib)
  - Tests pass: ruby 1.8.7, 1.9.2, jruby 1.5.6, jruby 1.6.0.RC2 on OS X
  - Tests pass: ruby 1.8.7, 1.9.2, jruby 1.5.6 on Ubuntu 10.04
  - Remove Ruby stuff from the rpm grok.spec; if you want ruby grok, you will
    need to install 'jls-grok' from rubygems (and also ffi)

1.20110223.*
  - Allow ':' and '_' in pattern subnames, like: %{FOO:bar:baz}
  - Pete Fritchman rewrite the ruby bindings in FFI instad of C.

1.20101117.*
  - Packaging fixes

1.20101030.*
  - Add 'make package-debian' to produce a .deb build of grok.

1.20101018.*
  - API docs via doxygen
  - rdoc for the Ruby module
  - Add Grok::Pile to Ruby

1.20100419.*
  - Fix tests
  - Add a ruby example for pattern discovery
  - Add grok-web example (runs grok in ruby via sinatra to show pattern discovery)
  - Add more time formats (US, EU, ISO8601)
  - Fix bug that prevented multiple patterns with the same complexity from being
    used in discovery.

1.20100416.*
  - Add pattern discovery through grok_discover (C) and Grok#discover (Ruby)
    Idea for this feature documented here:
    http://www.semicomplete.com/blog/geekery/grok-pattern-autodiscovery.html
  - The ruby gem is now called 'jls-grok' since someone already had the 'grok'
    gem name on gemcutter.
  - Fix some pattern errors found in the test suite.
  - New version numbering to match my other tools.

20091227.01
  - Add function to get the list of loaded patterns.
  - Ruby: new method Grok#patterns returns a Hash of known patterns.
  - Added flags to grok: -d and --daemon to daemonize on startup (after config
    parsing). Also added '-f configfile' for specifying the config file.
  - Added manpage (grok.1, generated from grok.pod)

20091110
  - match {} blocks can now have multiple 'pattern:' instances
  - Include samples/ directory of grok configs in release package.

20091103
  - New: ruby bindings are now really supported.
  - Change 'WORD' pattern to be word bounded (\b)
  - Move grok-patterns to patterns/base
  - update rpm spec to install patterns/base in /usr/share/grok

20091102
  - Add a bunch of tests, mostly in ruby, to exercise grok. This uncovered a 
    few bugs which are fixed.
    All tests currently pass (both CUnit and Ruby Test::Unit) on:
    * FreeBSD 7.1. tokyocabinet 1.4.30, pcre 8.00, libevent 1.4.12
    * Ubuntu 9.04. tokyocabinet 1.4.35, pcre 7.8-2, libevent 1.3e-3 
    * CentOS 5.3. tokyocabinet 1.4.9-1, pcre 7.8-2, libevent 1.1a-3.2.1
  - When making strings in ruby, we now make them tainted per ruby C docs.
  - "Too many replacements" error will now occur if you have cyclic patterns,
    such as defining 'FOO' to be '%{FOO}'. Max replacements is 500.

20091030
  - Make 'grok' main take a config for an argument.
  - Add grok rpm spec.
  - Updated Makefile to work on Linux and FreeBSD without modification.
  - Fixed bug introduced in 20091022 where capture_by_(name,subname) didn't
    work properly.
  - Add default values for match {} grok.conf blocks:
    shell: stdout
    reaction: "%{@LINE}"
  - Have grok exit nonzero if there were no reactions executed, akin to grep(1)
    not matching anything. 'reactions' are important here; matches with no
    reaction will not count as a reaction.

20091023
  - Fix libgrok accidentally sharing it's parser/lexer functions. Turns out,
    libgrok doesn't actually need to parse the grok.conf, so we don't build
    against it anymore for the library.

20091022:
  - Convert to using tokyocabinet instead of berkeley db.
    * Berkeley DB isn't easy to target across platforms (4.x versions vary
      wildly in bugs)
    * tokyo cabinet should be faster
    * tokyo cabinet is less code to write, and slightly more readable in the
      author's opinion.  
    * we don't have to serialize with xdr anymore
  
20091019:
  - include pregenerated bison/flex output since gnu flex varies much from
  non-gnu flex, and many important platforms don't have gnu flex available
  easily from packages (freebsd, centos, etc) but come with the other flex.

  No functional changes.

20090928:
  - perl grok is dead. Long live new grok.
  - This code should be considered usable, but beta quality.