Thinking about it for a couple another option would be something like a
PStatOpenJSON directive, that would emit an json message without the
brackets:
"name":"imuxsock", "submitted":0, "ratelimit.discarded":0
that could then be combined with an output template like...
"{ \"foo\":\"bar\", \"baz\":\"bat\", %msg% }\n"
On Wed, Jun 13, 2012 at 3:31 PM, Brian Knox <[email protected]> wrote:
> Rainer -
>
> I'm working on getting imstats data emitted by the module into a
> "flattened" cee-like json list. (This is part of what I was doing earlier
> today when I emailed about the mmjsonparse issue).
>
> So (of course speaking of after mmjsonparse in a rsyslog 6 style block is
> working properly) if I set $PStatCEE on, and pass the resulting message to
> mmjson parse, and then output using a template that uses "%$!all-json%\n",
> the resulting message is like:
>
> {"name": "imuxsock", "submitted": "0", "ratelimit.discarded": "0",
> "ratelimit.numratelimiters": "0"}
>
> Which is of course pretty much the same as the original messages:
>
> 2012-06-13T11:33:10.894045-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"emerg_action","processed":0,"failed":0}
>
> What I would like to do at this point is get the time the stat was
> generated into the message. I want to do this in order to get a totally
> flat JSON message versus the way I've been doing it in the past, which was
> to use a template to create a nested document like:
>
> {"time":1339035848,
> "stat":{"name":"authpriv_action","processed":10,"failed":0}}
>
> My end goal is:
>
> {"time": 1339035848, "name":"authpriv_action", "processed":10, "failed":0}
>
> I could of course forward the message to a service that rewrites the json,
> but this is an extra parsing step I'd rather not do.
>
> It seems to me my options would be to somehow get the time of the emitted
> message from the impstats module itself, and pass it to the the call that
> in return calls getAllStatsLines so it can be inserted into the message, or
> do it directly in statsobj if the time is available there.
>
> So I suppose my questions are:
>
> 1) is there an easier way to do this, and
> 2) if not, is there a more preferred way to do this, and
> 3) does this sound reasonable :)
>
> Brian
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
