Hello,
I like mmjsontransform, it sounds good. You could then probably remove
the unflatten script function contrib/fmunflatten as it is doing the
same with more features. We are using it to normalize json (unflatten)
before elasticsearch ingest but we could switch to your new module, that
would save maintaining that code; moreover elasticsearch can do it at
ingest time now.
Regards,
Julien
On 14/10/2025 18:00, Florian Riedl via rsyslog wrote:
We are pleased to announce rsyslog 8.2510.0 (aka 2025.10).
This release focuses on better Windows Security event parsing,
easier JSON handling, improved compatibility with modern
Elasticsearch and Kafka, and numerous documentation and CI updates.
Highlights:
- new module mmsnareparse for structured Windows Security event logs
- mmjsonparse: new find-json mode for embedded JSON
- mmjsontransform: experimental module for dotted-key un/flatten
- template: new option.jsonftree for nested JSON output
- omelasticsearch: auto-detect ES/OpenSearch version, typeless by default
- omkafka: restored compatibility with older librdkafka
- imhttp: /health and /metrics endpoints now support Basic Auth
- new message property fromhost-port and clearer imtcp TLS errors
- new RainerScript functions: b64_decode() and toupper()
- build and CI: openEuler 24.03 LTS added, doc spellcheck, security checks
- various bugfixes and refactoring for clarity and stability
Full details are available at:
https://www.rsyslog.com/rsyslog-8-2510-0-2025-10-released/
As always, we recommend testing in a staging environment before
production rollout. Packages for RHEL/CentOS and Ubuntu are readily
available
as well.
Best regards,
The rsyslog team
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
