I've finally gotten around to testing out the mmnormalize / mmjson features
in the current rsyslog dev branch. We have mmnormalize working in tests,
parsing some "legacy" syslog messages into JSON. I'm now trying to get the
other side of the coin working - parsing "cee enhanced" messages and making
decisions based on the exposed attributes.
First attempt:
$template json_test,"original: %rawmsg%, att: %att%\n"
*.* :mmjson:
*.* /var/log/json_test.log;json_test
>From the command line:
[root@arthur etc]# logger "@cee: {\"att\":\"hello\"}"
In the log:
original: <13>Mar 13 11:28:37 bknox: @cee: {"att":"hello"}, att: **INVALID
PROPERTY NAME**att**INVALID PROPERTY NAME**
I know my message generated by logger doesn't contain the hostname field -
didn't know if this was important for mmjson to recognize the message. I'd
love to get a simple test case working if someone with some experience with
mmjson can offer some pointers.
Thanks!
Brian
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
