> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Radu Gheorghe > Sent: Thursday, March 15, 2012 8:20 AM > To: rsyslog-users > Subject: Re: [rsyslog] escaping quotes in a property > > Hi Rainer, > > I'm also very interested in the topic, because I'm using > omelasticsearch, and I don't want to index all the data, just some of > the fields.
Side-note: I think I will try to move all RESTful interface into a common direction, this would cover, for example, not only elasticsearch but couchdb as well (and probably many others, even new ones not yet written ;)). Keep you posted, Rainer > > Just so you know there's a +1 :D > > Best regards, > Radu > > 2012/3/15 Rainer Gerhards <[email protected]>: > > It's actually not only double quotes, but some other characters that > need to > > be escaped in JSON. There is an overall question on how to do the > JSON > > encoding best within the current template system. I am about to blog > about > > this question, too. Not sure if I manage today, as I have some > important > > support case to look at. Please bear with me, I'll keep you posted. > > > > Rainer > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Brian Knox > >> Sent: Wednesday, March 14, 2012 7:41 PM > >> To: rsyslog-users > >> Subject: [rsyslog] escaping quotes in a property > >> > >> I'm currently playing around with a "minimal cee template" as per > the > >> notes > >> here: > >> > >> http://cee.mitre.org/docs/cls.html > >> > >> For my tests I'm using the following template: > >> > >> $template > >> > minimal_cee,"{\"Event\":{\"p_proc\":\"%programname%\",\"p_sys\":\"%host > >> > name%\",\"time\":\"%timestamp%\"},\"Msg\":{\"raw_msg\":\"%rawmsg%\"}}\n > >> " > >> > >> This works fine for simple tests, unless I log a message that > includes > >> quotes in the message payload: > >> > >> input: > >> [bknox@arthur log_spew]$ logger "this is \"a test\"" > >> > >> output: > >> {"Event":{"p_proc":"bknox","p_sys":"arthur","time":"Mar 14 > >> 14:37:04"},"Msg":{"raw_msg":"<13>Mar 14 14:37:04 bknox: this is "a > >> test""}} > >> > >> This of course now will not parse as valid JSON. > >> > >> It would be great to have a property option ( > >> http://www.rsyslog.com/doc/property_replacer.html ) that allowed > >> escaping > >> double quotes within a message property (unless there's another way > of > >> doing this that I'm missing). > >> > >> Brian > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
