Hi,
That's weird, I thought the "json" option would do exactly that. It
certainly works with version 7+, take a look here:
http://blog.sematext.com/2013/07/01/recipe-rsyslog-elasticsearch-kibana/
What version are you using?
2014/1/22 Per-Erik Persson <pe...@kth.se>
> I am passing data from rsyslog to logstash and to pass on some special
> fields I need to jsonencapsulate the data.
> It is passed via syslog to logstash since this seems to be the only
> format working at the moment.
>
> My template looks like this:
> $template
>
> ls_json,"{%timereported:::date-rfc3339,jsonf:timestamp%,%source:::jsonf:@source_host
> %,\"@source\":\"syslog://%fromhost-ip:::json%\",\"@message\":\"%msg::::json%\",\"@fields\":{%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%,%fromhost:::jsonf%,%fromhost-ip:::jsonf%}}"
>
> Not surprisingly it barfs when the msg field contains an double quote "
> Is it possible to "pre-escape" the doublequote to be \" within the msg
> field?
> At least I assume that would be the easiest way to do it.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
