On Oct 10, 2014, at 6:25 AM, Rainer Gerhards <[email protected]> wrote:
> ... In v8-devel, I could envision something along these lines:
>
> template(name="testTemplate3" type="list" format="jsonf") {
> property(outname="@timestamp" name="timereported" dateFormat="rfc3339")
> property(outname="host" name="hostname")
> property(outname="severity" name="syslogseverity-text")
> property(outname="facility" name="syslogfacility-text")
> property(outname="tag" name="syslogtag")
> property(outname="message" name="msg")
> }
>
> Would that be better? If so, do you think that would be worth the effort
> implementing it (given the long list of other feature requests)?
I do like this structure better, but think using the term 'label' rather than
'outname' might be a better fit. Also, is it safe to assume that by setting
the 'format="jsonf" at the template level, all enclosed properties will inherit
that formatting, and therefore if you don't specify an 'outname' (or 'label')
it will just use the property name? Here's a slightly different proposed
config:
template(name="testJsonTemplate" type="list" format="jsonf") {
property(name="timereported" dateFormat="rfc3339" label="@timestamp") # =>
"@timestamp":"1996-12-19T16:39:57-08:00",
property(name="hostname") # =>
"hostname":"logbox",
property(name=...
}
which helps highlight the 'label' option as an optional change, like "Print out
the timereported property in rfc3339 format, but call it @timestamp instead."
In my own experience at least, the property names in rsyslog frequently don't
match the key names I want in the JSON output, so I think use of this
functionality will be more common over time.
On a related topic -- I'm not sure I understand why we need 'jsonr' and
'jsonrf' on top of 'json' and 'jsonf' formats. Shouldn't 'json' format just be
fixed to do what 'jsonr' does because 'json' generates invalid string encoding
in some cases (and similar for 'jsonf')? The doc suggests that the only
difference is that jsonr "avoids double escaping the value but makes it safe
for a json field." Wouldn't you always want that?
- Dave
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
