I believe the template is being taken... earlier I did a test template that
was "alljson: %!all-json%\n" and I would get lines in the log that were:
alljson:
alljson:
alljson:
I tried using a couple of specific properties from the json as well and
that didn't work. Trying now with the mixed config as below, and a slight
changed template I get:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
some json should be here:
but using the style of
*.* :mmjsonparse:
*.* /path/to/my/file;template
with the same template I get:
some json should be here: {"name": "imuxsock", "submitted": "0",
"ratelimit.discarded": "0", "ratelimit.numratelimiters": "0"}
some json should be here: {"name": "pstats_file", "processed": "112",
"failed": "0"}
some json should be here: {"name": "action 2", "processed": "112",
"failed": "0"}
some json should be here: {"name": "action 3", "processed": "127",
"failed": "0"}
some json should be here: {"name": "action 4", "processed": "127",
"failed": "0"}
some json should be here: {"name": "authpriv_action", "processed": "0",
"failed": "0"}
some json should be here: {"name": "mail_action", "processed": "0",
"failed": "0"}
some json should be here: {"name": "cron_action", "processed": "0",
"failed": "0"}
some json should be here: {"name": "info_action", "processed": "1",
"failed": "0"}
some json should be here: {"name": "emerg_action", "processed": "0",
"failed": "0"}
some json should be here: {"name": "local7_action", "processed": "0",
"failed": "0"}
some json should be here: {"name": "file_log_all", "processed": "127",
"failed": "0"}
some json should be here: {"name": "mongo_log_all", "processed": "127",
"failed": "127"}
some json should be here: {"name": "main Q", "size": "13", "enqueued":
"140", "full": "0", "discarded.full": "0", "discarded.nf": "0", "maxqsize":
"15"}
So it looks like for some reason, with the new style config block, that
either the json derived properties are not getting set, or are somehow
going out of scope before the action?
Brian
On Wed, Jun 13, 2012 at 10:08 AM, Rainer Gerhards
<rgerha...@hq.adiscon.com>wrote:
> Maybe the problem is that the template is not properly taken. Try this:
>
> if ($programname == 'rsyslogd-pstats') then {
> action(name="parse" type="mmjsonparse")
> /data/rsyslog/logs/json_parse.log;parse_test
> }
>
> (yes, you can mix&match old and new style ... not that I recommend this,
> it's a side-effect of the need to support old style at all).
>
> Rainer
>
> > -----Original Message-----
> > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog-
> > boun...@lists.adiscon.com] On Behalf Of Brian Knox
> > Sent: Wednesday, June 13, 2012 4:06 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] rule blocks and mmjsonparse
> >
> > Some more information....
> >
> > $template parse_test,"%$!all-json%\n"
> >
> > if ($programname == 'rsyslogd-pstats') then {
> > action(name="parse" type="mmjsonparse")
> > action(name="pstats_file" type="omfile"
> > file="/data/rsyslog/logs/pstats_json.log" template="parse_test")
> > }
> >
> > *.* :mmjsonparse:
> > *.* /data/rsyslog/logs/json_parse.log;parse_test
> >
> > Given the above, json_parse.log contains empty lines, while
> json_parse.log
> > is correct.
> >
> >
> >
> >
> >
> > On Tue, Jun 12, 2012 at 4:44 PM, Brian Knox <bri...@talksum.com> wrote:
> >
> > > I have a situation on rsyslog 6 (dev branch!) where, using the new
> config
> > > format, I'd like to run only messages that match a filter condition
> through
> > > mmjsonparse. First of all, is this possible, and secondly, what would
> the
> > > syntax be?
> > >
> > > Essentially, in pseudoish code I want:
> > >
> > > if ($programname == 'rsyslogd-pstats') then {
> > > 1. *.* mmjsonparse
> > > 2. (send messages to an output using a template)
> > > }
> > >
> > > Is it possible currently to use mmjsonparse against messages that only
> > > match a filter condition?
> > >
> > > Brian
> > >
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
