I was thinking of something like:
DDPPPMFF 2011-12-04 14:44 myproc 1234 procuser INFO "this line" "contains some data"
PFDF proc2 started 1326808384 "That is a silly place to put a time stamp"
Where D = datetime, P = process info, M = meta data, F = free text
That way, by parsing the first field you can know the format of the rest of the (space separated and quoted) line, whilst allowing for different line formats and keeping the flexibility and human readability of ASCII.
A command to read the dates might look something like
$ logcat D my.log
2011-12-04 14:44
1326808384
$
Does something like this exist already?
What are the downsides to this approach? I can think of one:
We still can't discover the difference between process name and the process user. Perhaps specific fields would have to be defined. Perhaps like:
DdDtPnPpPuMsFF
But that is starting to get a bit silly.
Actually, while we're at it, lets at tagging:
DDPPPMFFT 2011-12-04 14:44 myproc 1234 procuser INFO "this line" "contains some data" "testing,login,user,authentication"
PFDFT proc2 started 1326808384 "That is a silly place to put a time stamp" "testing,debug,user"
And a command
$ logtag --freq *.log
testing 2
user 2
authentication 1
debug 1
login 1
$