Rainer -
I'm working on getting imstats data emitted by the module into a
"flattened" cee-like json list. (This is part of what I was doing earlier
today when I emailed about the mmjsonparse issue).
So (of course speaking of after mmjsonparse in a rsyslog 6 style block is
working properly) if I set $PStatCEE on, and pass the resulting message to
mmjson parse, and then output using a template that uses "%$!all-json%\n",
the resulting message is like:
{"name": "imuxsock", "submitted": "0", "ratelimit.discarded": "0",
"ratelimit.numratelimiters": "0"}
Which is of course pretty much the same as the original messages:
2012-06-13T11:33:10.894045-04:00 localhost rsyslogd-pstats: @cee:
{"name":"emerg_action","processed":0,"failed":0}
What I would like to do at this point is get the time the stat was
generated into the message. I want to do this in order to get a totally
flat JSON message versus the way I've been doing it in the past, which was
to use a template to create a nested document like:
{"time":1339035848,
"stat":{"name":"authpriv_action","processed":10,"failed":0}}
My end goal is:
{"time": 1339035848, "name":"authpriv_action", "processed":10, "failed":0}
I could of course forward the message to a service that rewrites the json,
but this is an extra parsing step I'd rather not do.
It seems to me my options would be to somehow get the time of the emitted
message from the impstats module itself, and pass it to the the call that
in return calls getAllStatsLines so it can be inserted into the message, or
do it directly in statsobj if the time is available there.
So I suppose my questions are:
1) is there an easier way to do this, and
2) if not, is there a more preferred way to do this, and
3) does this sound reasonable :)
Brian
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
