Aha! That makes sense, given the %$!all-json% example in the docs; I should have thought of it. I'll give that a shot in a few. It's not too bad, just gives me flashbacks to being a Perl programmer ;)
Brian On Tue, Mar 13, 2012 at 1:01 PM, Rainer Gerhards <[email protected]>wrote: > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Brian Knox > > Sent: Tuesday, March 13, 2012 4:52 PM > > To: [email protected] > > Subject: [rsyslog] mmjson attempts > > > > I've finally gotten around to testing out the mmnormalize / mmjson > > features > > in the current rsyslog dev branch. We have mmnormalize working in > > tests, > > parsing some "legacy" syslog messages into JSON. I'm now trying to get > > the > > other side of the coin working - parsing "cee enhanced" messages and > > making > > decisions based on the exposed attributes. > > > > First attempt: > > > > $template json_test,"original: %rawmsg%, att: %att%\n" > > *.* :mmjson: > > *.* /var/log/json_test.log;json_test > > > > From the command line: > > [root@arthur etc]# logger "@cee: {\"att\":\"hello\"}" > > > > In the log: > > original: <13>Mar 13 11:28:37 bknox: @cee: {"att":"hello"}, att: > > **INVALID > > PROPERTY NAME**att**INVALID PROPERTY NAME** > > The field name syntax is weird, it's classified as an "extended system > variable" and thus has the prefix "$!" so "%$!att%" ;) A full-blown > example: > > http://www.rsyslog.com/receiving-cee-enhanced-syslog-in-rsyslog/ > > I know its ugly, but I needed to go with the current system. Plan is to add > better name support as part of the new config (which slowly comes into > action). > > Rainer > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
