I managed to get it to work. I think the only way to make this work is to use the multi-decoder as I still need all other syslog messages to be processed in heka and passed onto es.
On 05/10/15 22:58, Rob Miller wrote: > On 10/5/15 9:59 AM, Robert Gardam wrote: >> Hi All, >> I'm just trying out moving from logstash and I'm wondering how does one >> push one message from one decoder into another decoder after it has been >> decoded the first time. >> >> Essentially i'm decoding json rsyslog messages from a tcp input and then >> I want to pass only one field into the nginx access log decoder. > Most of the work for the nginx access decoder is done in a module, so > I'd recommend just copying the nginx decoder code and adding your JSON > parsing right in the same decoder. >> I can multi decode, but this only seems to decode json first but not >> pass the json message into the second decoder. > MultiDecoder should work, albeit less efficiently. You have to set > `cascade_strategy = "all"` (the default is "first-wins") for your use > case, though; did you set that? > > -r > > _______________________________________________ > Heka mailing list > [email protected] > https://mail.mozilla.org/listinfo/heka -- Robert Gardam DevOps Engineer Native Instruments GmbH +49-30-611035-1775 www.native-instruments.com _______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
