On 10/5/15 9:59 AM, Robert Gardam wrote:
Hi All,
I'm just trying out moving from logstash and I'm wondering how does one
push one message from one decoder into another decoder after it has been
decoded the first time.
Essentially i'm decoding json rsyslog messages from a tcp input and then
I want to pass only one field into the nginx access log decoder.
Most of the work for the nginx access decoder is done in a module, so I'd
recommend just copying the nginx decoder code and adding your JSON parsing
right in the same decoder.
I can multi decode, but this only seems to decode json first but not
pass the json message into the second decoder.
MultiDecoder should work, albeit less efficiently. You have to set `cascade_strategy =
"all"` (the default is "first-wins") for your use case, though; did you set
that?
-r
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
