original: <13>Mar 13 13:19:02 bknox: @cee: {"att":"hello"}, att: helloThat did the trick! Now it's time to play. Brian On Tue, Mar 13, 2012 at 1:12 PM, Brian Knox <bri...@talksum.com> wrote: > Aha! That makes sense, given the %$!all-json% example in the docs; I > should have thought of it. I'll give that a shot in a few. It's not too > bad, just gives me flashbacks to being a Perl programmer ;) > > Brian > > > On Tue, Mar 13, 2012 at 1:01 PM, Rainer Gerhards <rgerha...@hq.adiscon.com > > wrote: > >> > -----Original Message----- >> > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- >> > boun...@lists.adiscon.com] On Behalf Of Brian Knox >> > Sent: Tuesday, March 13, 2012 4:52 PM >> > To: rsyslog@lists.adiscon.com >> > Subject: [rsyslog] mmjson attempts >> > >> > I've finally gotten around to testing out the mmnormalize / mmjson >> > features >> > in the current rsyslog dev branch. We have mmnormalize working in >> > tests, >> > parsing some "legacy" syslog messages into JSON. I'm now trying to get >> > the >> > other side of the coin working - parsing "cee enhanced" messages and >> > making >> > decisions based on the exposed attributes. >> > >> > First attempt: >> > >> > $template json_test,"original: %rawmsg%, att: %att%\n" >> > *.* :mmjson: >> > *.* /var/log/json_test.log;json_test >> > >> > From the command line: >> > [root@arthur etc]# logger "@cee: {\"att\":\"hello\"}" >> > >> > In the log: >> > original: <13>Mar 13 11:28:37 bknox: @cee: {"att":"hello"}, att: >> > **INVALID >> > PROPERTY NAME**att**INVALID PROPERTY NAME** >> >> The field name syntax is weird, it's classified as an "extended system >> variable" and thus has the prefix "$!" so "%$!att%" ;) A full-blown >> example: >> >> http://www.rsyslog.com/receiving-cee-enhanced-syslog-in-rsyslog/ >> >> I know its ugly, but I needed to go with the current system. Plan is to >> add >> better name support as part of the new config (which slowly comes into >> action). >> >> Rainer >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
