Ok, need to look into it - but some other things in front oft he queue :-( Could you get me a debug log? Maybe a quick glance at it could enlighten me ;)
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Brian Knox > Sent: Wednesday, June 13, 2012 4:16 PM > To: rsyslog-users > Subject: Re: [rsyslog] rule blocks and mmjsonparse > > I believe the template is being taken... earlier I did a test template that > was "alljson: %!all-json%\n" and I would get lines in the log that were: > > alljson: > alljson: > alljson: > > I tried using a couple of specific properties from the json as well and > that didn't work. Trying now with the mixed config as below, and a slight > changed template I get: > > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > some json should be here: > > but using the style of > > *.* :mmjsonparse: > *.* /path/to/my/file;template > > with the same template I get: > > some json should be here: {"name": "imuxsock", "submitted": "0", > "ratelimit.discarded": "0", "ratelimit.numratelimiters": "0"} > some json should be here: {"name": "pstats_file", "processed": "112", > "failed": "0"} > some json should be here: {"name": "action 2", "processed": "112", > "failed": "0"} > some json should be here: {"name": "action 3", "processed": "127", > "failed": "0"} > some json should be here: {"name": "action 4", "processed": "127", > "failed": "0"} > some json should be here: {"name": "authpriv_action", "processed": "0", > "failed": "0"} > some json should be here: {"name": "mail_action", "processed": "0", > "failed": "0"} > some json should be here: {"name": "cron_action", "processed": "0", > "failed": "0"} > some json should be here: {"name": "info_action", "processed": "1", > "failed": "0"} > some json should be here: {"name": "emerg_action", "processed": "0", > "failed": "0"} > some json should be here: {"name": "local7_action", "processed": "0", > "failed": "0"} > some json should be here: {"name": "file_log_all", "processed": "127", > "failed": "0"} > some json should be here: {"name": "mongo_log_all", "processed": "127", > "failed": "127"} > some json should be here: {"name": "main Q", "size": "13", "enqueued": > "140", "full": "0", "discarded.full": "0", "discarded.nf": "0", "maxqsize": > "15"} > > So it looks like for some reason, with the new style config block, that > either the json derived properties are not getting set, or are somehow > going out of scope before the action? > > Brian > > > > > On Wed, Jun 13, 2012 at 10:08 AM, Rainer Gerhards > <[email protected]>wrote: > > > Maybe the problem is that the template is not properly taken. Try this: > > > > if ($programname == 'rsyslogd-pstats') then { > > action(name="parse" type="mmjsonparse") > > /data/rsyslog/logs/json_parse.log;parse_test > > } > > > > (yes, you can mix&match old and new style ... not that I recommend this, > > it's a side-effect of the need to support old style at all). > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Brian Knox > > > Sent: Wednesday, June 13, 2012 4:06 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rule blocks and mmjsonparse > > > > > > Some more information.... > > > > > > $template parse_test,"%$!all-json%\n" > > > > > > if ($programname == 'rsyslogd-pstats') then { > > > action(name="parse" type="mmjsonparse") > > > action(name="pstats_file" type="omfile" > > > file="/data/rsyslog/logs/pstats_json.log" template="parse_test") > > > } > > > > > > *.* :mmjsonparse: > > > *.* /data/rsyslog/logs/json_parse.log;parse_test > > > > > > Given the above, json_parse.log contains empty lines, while > > json_parse.log > > > is correct. > > > > > > > > > > > > > > > > > > On Tue, Jun 12, 2012 at 4:44 PM, Brian Knox <[email protected]> wrote: > > > > > > > I have a situation on rsyslog 6 (dev branch!) where, using the new > > config > > > > format, I'd like to run only messages that match a filter condition > > through > > > > mmjsonparse. First of all, is this possible, and secondly, what would > > the > > > > syntax be? > > > > > > > > Essentially, in pseudoish code I want: > > > > > > > > if ($programname == 'rsyslogd-pstats') then { > > > > 1. *.* mmjsonparse > > > > 2. (send messages to an output using a template) > > > > } > > > > > > > > Is it possible currently to use mmjsonparse against messages that only > > > > match a filter condition? > > > > > > > > Brian > > > > > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
