Hi Rainer, I'm also very interested in the topic, because I'm using omelasticsearch, and I don't want to index all the data, just some of the fields.
Just so you know there's a +1 :D Best regards, Radu 2012/3/15 Rainer Gerhards <[email protected]>: > It's actually not only double quotes, but some other characters that need to > be escaped in JSON. There is an overall question on how to do the JSON > encoding best within the current template system. I am about to blog about > this question, too. Not sure if I manage today, as I have some important > support case to look at. Please bear with me, I'll keep you posted. > > Rainer > >> -----Original Message----- >> From: [email protected] [mailto:rsyslog- >> [email protected]] On Behalf Of Brian Knox >> Sent: Wednesday, March 14, 2012 7:41 PM >> To: rsyslog-users >> Subject: [rsyslog] escaping quotes in a property >> >> I'm currently playing around with a "minimal cee template" as per the >> notes >> here: >> >> http://cee.mitre.org/docs/cls.html >> >> For my tests I'm using the following template: >> >> $template >> minimal_cee,"{\"Event\":{\"p_proc\":\"%programname%\",\"p_sys\":\"%host >> name%\",\"time\":\"%timestamp%\"},\"Msg\":{\"raw_msg\":\"%rawmsg%\"}}\n >> " >> >> This works fine for simple tests, unless I log a message that includes >> quotes in the message payload: >> >> input: >> [bknox@arthur log_spew]$ logger "this is \"a test\"" >> >> output: >> {"Event":{"p_proc":"bknox","p_sys":"arthur","time":"Mar 14 >> 14:37:04"},"Msg":{"raw_msg":"<13>Mar 14 14:37:04 bknox: this is "a >> test""}} >> >> This of course now will not parse as valid JSON. >> >> It would be great to have a property option ( >> http://www.rsyslog.com/doc/property_replacer.html ) that allowed >> escaping >> double quotes within a message property (unless there's another way of >> doing this that I'm missing). >> >> Brian >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
