[
https://issues.apache.org/jira/browse/NIFI-5139?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16547053#comment-16547053
]
Bryan Bende commented on NIFI-5139:
-----------------------------------
I think there would be a few options...
1) Lets say you have ListenSyslog with a large batch size, then send to
PartitionRecord, and you have a dynamic property like:
SID = /structuredData/exampleSID@32473-iut
This would partition the records based on the value of that field in the
structured data map, then each out going flow file would have an attribute
called SID and you could use RouteOnAttribute to route the different SID values
to wherever.
2) Another option would to use ListenSyslog or ListenTCPRecord followed by
SplitRecord with a record count of 1 and a JsonWriter, then you have one JSON
document per flow file and you can use EvaluateJsonPath.
3) You could use ListenSyslog, followed by SplitText with line count of 1, and
then ParseSyslog5424 followed by RouteOnAttribute where you can use the
attributes like "syslog.structuredData.XYZ"
> ListenSyslog should process Structured Data
> -------------------------------------------
>
> Key: NIFI-5139
> URL: https://issues.apache.org/jira/browse/NIFI-5139
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 1.6.0
> Reporter: Aurélien DEHAY
> Priority: Minor
>
> Hello.
>
> The Structured Data as described in
> [https://tools.ietf.org/html/rfc5424#section-6.3] are not read by Nifi.
>
> I suggest the SD to be put in attributes, prefixed by the ID:
> [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"]
> to become 3 attributes
> * exampleSID@32473-iut = 3
> * exampleSID@32473-eventSource=Application
> * exampleSID@32473-eventID=1011
>
> This could be useful to preprocess RFC5424 message, prioritize or route them.
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
