> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Brian Knox > Sent: Tuesday, March 13, 2012 4:52 PM > To: [email protected] > Subject: [rsyslog] mmjson attempts > > I've finally gotten around to testing out the mmnormalize / mmjson > features > in the current rsyslog dev branch. We have mmnormalize working in > tests, > parsing some "legacy" syslog messages into JSON. I'm now trying to get > the > other side of the coin working - parsing "cee enhanced" messages and > making > decisions based on the exposed attributes. > > First attempt: > > $template json_test,"original: %rawmsg%, att: %att%\n" > *.* :mmjson: > *.* /var/log/json_test.log;json_test > > From the command line: > [root@arthur etc]# logger "@cee: {\"att\":\"hello\"}" > > In the log: > original: <13>Mar 13 11:28:37 bknox: @cee: {"att":"hello"}, att: > **INVALID > PROPERTY NAME**att**INVALID PROPERTY NAME**
The field name syntax is weird, it's classified as an "extended system variable" and thus has the prefix "$!" so "%$!att%" ;) A full-blown example: http://www.rsyslog.com/receiving-cee-enhanced-syslog-in-rsyslog/ I know its ugly, but I needed to go with the current system. Plan is to add better name support as part of the new config (which slowly comes into action). Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
