Re: [rsyslog] json properties

2019-09-17 Thread Brian Candler via rsyslog
On 17/09/2019 14:55, David Lang wrote: On Tue, 17 Sep 2019, Brian Candler wrote: - if $! is empty, $! as a property gives empty string but $!all-json and $!all-json-plain give {} - if $! is not empty, $! as a property gives the same as $!all-json; $!all-json-plain is similar but without

Re: [rsyslog] json properties

2019-09-17 Thread Rich Megginson via rsyslog
On 9/17/19 7:48 AM, Brian Candler via rsyslog wrote: On 17/09/2019 00:42, David Lang wrote: Just to confirm what I *think* is going on: $! is only the content which was parsed by mmjsonparse (otherwise empty or does not exist) $!all-json and $!all-json-plain are $! re-serialized as a JSON

Re: [rsyslog] json properties

2019-09-17 Thread David Lang via rsyslog
On Tue, 17 Sep 2019, Brian Candler wrote: - if $! is empty, $! as a property gives empty string but $!all-json and $!all-json-plain give {} - if $! is not empty, $! as a property gives the same as $!all-json; $!all-json-plain is similar but without whitespace padding so not exactly the

Re: [rsyslog] json properties

2019-09-17 Thread Brian Candler via rsyslog
On 17/09/2019 00:42, David Lang wrote: Just to confirm what I *think* is going on: $! is only the content which was parsed by mmjsonparse (otherwise empty or does not exist) $!all-json and $!all-json-plain are $! re-serialized as a JSON string I believe that $! and $!all-json and

Re: [rsyslog] json properties

2019-09-16 Thread David Lang via rsyslog
On Mon, 16 Sep 2019, Brian Candler via rsyslog wrote: On 16/09/2019 16:23, Brian Candler wrote: imudp omkafka   imkafka  ,-->... [message] --> rsyslog --> [kafka] -> rsyslog --->... `-->... Supplementary question. Suppose I were to write to

Re: [rsyslog] json properties

2019-09-16 Thread David Lang via rsyslog
On Mon, 16 Sep 2019, Brian Candler via rsyslog wrote: 1. I found these: jsonmesg $! $!all-json $!all-json-plain https://www.rsyslog.com/doc/master/configuration/properties.html documents only the first of these. https://www.rsyslog.com/doc/v8-stable/configuration/modules/mmjsonparse.html

Re: [rsyslog] json properties

2019-09-16 Thread Brian Candler via rsyslog
On 16/09/2019 16:23, Brian Candler wrote: imudp omkafka   imkafka  ,-->... [message] --> rsyslog --> [kafka] -> rsyslog --->... `-->... Supplementary question. Suppose I were to write to kafka* just the rawmsg plus minimal captured metadata,

[rsyslog] json properties

2019-09-16 Thread Brian Candler via rsyslog
Sorry, some more questions, this time relating to JSON properties. 1. I found these: jsonmesg $! $!all-json $!all-json-plain https://www.rsyslog.com/doc/master/configuration/properties.html documents only the first of these.