The "report_json" log template format seems to lack one backslash when
escaping quotes. My JSON recipient (Logstash) is not able to parse
Amavis' output in its current form.
This excerpt is not considered valid by Logstash nor jq(1):
{
"@timestamp": "2017-06-27T06:58:42.390Z",
"action": [
"PASS"
],
"actions_performed": "RelayedInbound",
[...]
"subject": "Welcome to the \\"clamav-virusdb\\" mailing list",
"subject_rot13": "Jrypbzr gb gur \\"pynzni-ivehfqo\\" znvyvat yvfg",
[...]
"type": "amavis"
}
Adding an extra backslash, the JSON is valid:
{
"@timestamp": "2017-06-27T06:58:42.390Z",
"action": [
"PASS"
],
"actions_performed": "RelayedInbound",
[...]
"subject": "Welcome to the \\\"clamav-virusdb\\\" mailing list",
"subject_rot13": "Jrypbzr gb gur \\\"pynzni-ivehfqo\\\" znvyvat yvfg",
[...]
"type": "amavis"
}
--
Bjørn
