On Thu, 31 Jan 2013, Gary Foster wrote:
I can easily break it down into the relevant fields with the rsyslog property
replacer and mmnormalize… I can get the timestamp referring URL, etc all out
of it. I can also build a basic CEE'ish sort of output using a template.
However, what I really want is to break it down and normalize it into
something that looks like this (written in json format, but I really want
access to it as invididual properties):
once you break it down with mmlognorm it should create individual properties
that you can then use throughout the rest of your rsyslog config (including
routing decisions)
Also, you should look at the recent enhancements to JSON use in v7. I believe
that you should be albe to get the message parsed, manipulate the variables
(deleting some you don't want to have show up later), and then outputing in the
json format.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
