I see where you are coming from. I also think this makes sense. However, it looks for me like an incarnation of improved JSON support inside the template processor, which takes some more time...
So question now how to create a work around... Need to think a bit about that. Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Brian Knox > Sent: Wednesday, June 13, 2012 9:32 PM > To: rsyslog-users > Subject: [rsyslog] statsobj.c > > Rainer - > > I'm working on getting imstats data emitted by the module into a > "flattened" cee-like json list. (This is part of what I was doing earlier > today when I emailed about the mmjsonparse issue). > > So (of course speaking of after mmjsonparse in a rsyslog 6 style block is > working properly) if I set $PStatCEE on, and pass the resulting message to > mmjson parse, and then output using a template that uses "%$!all-json%\n", > the resulting message is like: > > {"name": "imuxsock", "submitted": "0", "ratelimit.discarded": "0", > "ratelimit.numratelimiters": "0"} > > Which is of course pretty much the same as the original messages: > > 2012-06-13T11:33:10.894045-04:00 localhost rsyslogd-pstats: @cee: > {"name":"emerg_action","processed":0,"failed":0} > > What I would like to do at this point is get the time the stat was > generated into the message. I want to do this in order to get a totally > flat JSON message versus the way I've been doing it in the past, which was > to use a template to create a nested document like: > > {"time":1339035848, > "stat":{"name":"authpriv_action","processed":10,"failed":0}} > > My end goal is: > > {"time": 1339035848, "name":"authpriv_action", "processed":10, "failed":0} > > I could of course forward the message to a service that rewrites the json, > but this is an extra parsing step I'd rather not do. > > It seems to me my options would be to somehow get the time of the emitted > message from the impstats module itself, and pass it to the the call that > in return calls getAllStatsLines so it can be inserted into the message, or > do it directly in statsobj if the time is available there. > > So I suppose my questions are: > > 1) is there an easier way to do this, and > 2) if not, is there a more preferred way to do this, and > 3) does this sound reasonable :) > > Brian > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
