How to write TRUSTED journal fields?
Background:
I have a suit of my own console applications (written in C) which send messages to the journal. And I'd like to separate them from messages from other tools and services.
The namespace looks like a most promising criteria for that.
What I am doing
Since I am working with a console application, not a service, I am sending messages to the journal myself:
I see that message in the journal, but with journalctl -o verbose I do not see namespace designation for that message at all.
Man says:
man 3 sd_journal_send
The variable name must be in uppercase and consist only of characters, numbers and underscores, and may not begin with an underscore. (All assignments that do not follow this syntax will be ignored.)
So I am assuming, that if I send "_NAMESPACE" the function sd_journal_send just filters that field out.
some more confusion
If I send field as "NAMESPACE=my_tools" - the record in the journal do have a "NAMESPACE" field (without underscore!) And if I do journalctl --namespace=my_tools - I see all messages in the journal, from all tools and all services. Not filtered by the field.
What am I doing wrong?
Question
So how I am supposed to send a message from my console (not service!) application so that message would have a namespace designation and could be filtered with