Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-04 Thread Rainer Gerhards via rsyslog
> > Code w/ comments: > > > > https://github.com/rsyslog/liblognorm/blob/master/src/parser.c#L2578 > > That's what I remember seeing, but I don't see it in the documentation page Yeah, but it's a full feature for quite a while. As I said, there is a doc build problem or a doc issue in general.

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread David Lang via rsyslog
On Fri, 3 Mar 2023, Rainer Gerhards wrote: I checked a bit ;-) is it as simple as taking the PR and changing the type name? I need to look, but probably not - else I would have done it. That would cause a lot of code duplication - bad. The proper solution is to control this via options.

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread Rainer Gerhards via rsyslog
I checked a bit ;-) > > is it as simple as taking the PR and changing the type name? > > I need to look, but probably not - else I would have done it. That would cause a lot of code duplication - bad. The proper solution is to control this via options. > > > > > given that we don't have an

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread Rainer Gerhards via rsyslog
> is it as simple as taking the PR and changing the type name? I need to look, but probably not - else I would have done it. > > given that we don't have an existing name-value type, what backwards > compatibility broke? We already have one, the iptables type. Rainer

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread David Lang via rsyslog
is it as simple as taking the PR and changing the type name? given that we don't have an existing name-value type, what backwards compatibility broke? David Lang On Fri, 3 Mar 2023, Rainer Gerhards wrote: note that I know I've seen patches go by for the name-value type, but I'm not seeing

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread Rainer Gerhards via rsyslog
> note that I know I've seen patches go by for the name-value type, but I'm not > seeing it in the documentation at > https://www.liblognorm.com/files/manual/configuration.html#field-types > > @rainer, have those patches not made it to a release? IIRC no, because they broke backwards

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread David Lang via rsyslog
...@tin.it" Subject: Re: [rsyslog] R: Re: R: Re: received json log format Hello I try debugging with with: action( name="normalize" type="mmnormalize" useRawMsg="off" rulebase="/etc/rsyslog.d/rulebase.rb" path="$.logrecord" ) Debug line with

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-03 Thread amaury--- via rsyslog
ntIp:ipv4% "] path="$!normalized_msg" variable="$!msg") action( name="logs-udp" type="omfile" DynaFile="rmt_sys_netlogs_udp" DirOwner="root" DirGroup="net

Re: [rsyslog] R: Re: R: Re: received json log format

2023-03-02 Thread David Lang via rsyslog
On Thu, 2 Mar 2023, amaury--- via rsyslog wrote: Hi David thank you for your suggest. This is the debug: Debug line with all properties: FROMHOST: 'public.', fromhost-ip: 'xxx.xxx.xxx.xxx', HOSTNAME: 'xxx.xxx.xxx.xxx', PRI: 14, syslogtag 'TOOL:', programname: 'TOOL', APP-NAME: 'TOOL', PROCID:

[rsyslog] R: Re: R: Re: received json log format

2023-03-02 Thread amaury--- via rsyslog
Hi David thank you for your suggest. This is the debug: Debug line with all properties: FROMHOST: 'public.', fromhost-ip: 'xxx.xxx.xxx.xxx', HOSTNAME: 'xxx.xxx.xxx.xxx', PRI: 14, syslogtag 'TOOL:', programname: 'TOOL', APP-NAME: 'TOOL', PROCID: '-', MSGID: '-', TIMESTAMP: 'Mar 2 10:10:45',