On Tue, 17 Dec 2013, Pavel Levshin wrote:
17.12.2013 12:31, Rainer Gerhards:
Folks,
I could need a bit of technical advise. There is a problem with the way
logger /imuxsock work and JSON escaping. The details are here:
http://kb.monitorware.com/post24048.html
Feedback appreciated, I'd like to settle this within the next two days ;)
Frankfully, I do not understand what topic starter wants to do.
The template:
template(name="plain_syslog" type="list") {
constant(value="{")
property(name="msg" format="json")
constant(value="\"}")
constant(value="\n")
}
It should output something in curly braces, yes? Something alike to JSON
container? Why there is an unpaired double quote, by the way?
What it does now?
What is it supposed to output?
The above results in 'there is a \\n in here'
So where are those curly braces? What is the real output?
My feeling is that logger is not supposed to allow escaped characters to be
passed to it's input. It does not decode anything. So, if JSON needs to
escape those slashes - this is the right behaviour.
The question has numerous errors in it (as you are noteing), but the fundamental
question is if there should be a way to put a newline or other control character
into the output.
This user is attempting to do so by embedding \n into the string to put a
newline there. Rsyslog isn't interpreting this as a newline, but it does note
the \ and so it escapes the \.
Is it time to add more support for \n \t etc control characters in templates?
There are not many times when you want them in there, but once in a while you
do, and there is a very common convention for how to put them in, and we do not
currently support it.
I think it would be a good thing to do, but I think it is well behind the doc
and repo changes, the v8 core changes, and the imfile changes.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
