Hi!
Rainer, Mariusz, thank you for your help.
Marcin
W dniu 2022-10-06 16:39, Rainer Gerhards napisał(a):
It's contributed code.
Albeit I have done some improvements, I need to familiarize myself
again with the module. IAW: it will take some time ;-)
Rainer
El mié, 5 oct 2022 a las 16:04,
It's contributed code.
Albeit I have done some improvements, I need to familiarize myself
again with the module. IAW: it will take some time ;-)
Rainer
El mié, 5 oct 2022 a las 16:04, Marcin Mirosław via rsyslog
() escribió:
>
> It would be easier to fix if it would be my misconfiguration :(
>
It would be easier to fix if it would be my misconfiguration :(
Rainer, would you look into ommongodb module, please?
Marcin
W dniu 2022-10-05 12:20, Mariusz Kruk via rsyslog napisał(a):
There is also some inconsistency within the documentation page (it
lists OMSR_TPL_AS_MSG as the default
There is also some inconsistency within the documentation page (it lists
OMSR_TPL_AS_MSG as the default template whereas few lines later it shows
a definition of a template named BSON which is supposed to be default).
So I suspect that something wasn't quite finished here ;-)
On 5.10.2022
Out of sheer curiosity I looked into the ommongodb.c and found this:
557 if(pData->tplName == NULL) {
558 doc = getDefaultBSON(*(smsg_t**)pMsgData);
559 } else {
560 doc = BSONFromJSONObject(*(struct json_object **)pMsgData);
561 }
I'm not that good in rsyslog
Hi!
If I use omfile then logs contains messages in my desired format but not
with ommongodb. tcpdump shows:
..msg.{"foo":"bar"}..
Marcin
W dniu 2022-10-05 08:05, Mariusz Kruk via rsyslog napisał(a):
Looks relatively normal.
You can of course try writing to a file with your "i-json"
Looks relatively normal.
You can of course try writing to a file with your "i-json" template to
make sure that's what you want to be sent to mongodb.
But then, if your ommongodb action does contain the template="i-json"
parameter, it simply should work.
The only other thing you can do to
:)
I had to censore log...
Debug line with all properties:
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'linux', PRI:
174,
syslogtag 'a1', programname: 'x1', APP-NAME: 'x1', PROCID: '-', MSGID:
'-',
TIMESTAMP: 'Oct 4 15:38:53', STRUCTURED-DATA: '[timeQuality tzKnown="1"
:-)
OK, I understand that you did
template(name="i-json" type="string" string="%msg%")
action(type="ommongodb" server="..." [...] template="i-json")
right?
This way you should indeed be pushing the %msg% part of the incoming
syslog message.
Try adding
action(type="omfile"
You didn't read the docs, did you? ;-)
https://www.rsyslog.com/doc/v8-stable/configuration/modules/ommongodb.html
"Note rsyslog contains a canned default template to write to the
MongoDB. It will be used automatically if no other template is specified
to be used. This template is:
W dniu 03.10.2022 o 18:55, Mariusz Kruk via rsyslog pisze:
Don't know about this particular output module but in general what you
want is for rsyslog to parse the message and insert it as json object.
Meseems that now rsyslog put %msg% as json object. (
ex: msg: '{"foo":"bar"}' }
)
So you
Don't know about this particular output module but in general what you
want is for rsyslog to parse the message and insert it as json object.
So you need to use parse_json() function on the input string and then
use proper template which will render the json to appropirate string. I
use
Maybe when I show examples from mongo it will be more clear.
> db.log2.find()
[
{ _id: ObjectId("633b0ea6b8f2a532cfa6c64c"), msg: '{"foo":"bar"}' },
{ _id: ObjectId("633b0eb6b8f2a532cfa6c64d"), foo: 'bar' }
]
First record shows how msg is inserted to mongo by rsyslog. Second
record is what
I do not fully understand the question (maybe language issue on my
side), but there is a syntax error:
In a string template, properties must be enclosed in percent sign. so:
... string="%msg%
HTH
Rainer
El lun, 3 oct 2022 a las 13:18, Marcin Mirosław via rsyslog
() escribió:
>
> Hello!
> Field
Hello!
Field msg contains complete json with data. I would like to instert it
to mongodb as is. But now rsyslog inserts it as a value of key "msg".
So now is:
msg: '{"foo":"bar"}
a i'd like to insert: only:
'{"foo","bar"}'
I tried with template:
template(name="ui-json" type="string"
15 matches
Mail list logo
