Radu,
> -----Original Message-----
> From: [email protected] [mailto:rsyslog-
> [email protected]] On Behalf Of Radu Gheorghe
> Sent: Monday, January 07, 2013 3:47 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Some list templates with mmjsonparse try to get
> 2GB of RAM or give OOM
>
> Wow, that was fast! Thanks, Rainer!
>
> Regarding the related questions:
> - please let me know if there's any issue with using $!all-json. I
> would
> need to use it to handle with CEE-enhanced and "regular" logs with the
> same
> template - and output a JSON. Something like:
>
> template(name="testTemplate"
> type="list") {
> constant(value="{")
> constant(value="\"@timestamp\":\"")
> property(name="timereported" dateFormat="rfc3339")
> constant(value="\",")
> property(name="$!all-json" position.from="2")
> }
>
> I can work around that with 2 templates and %parsesuccess%, but I find
> the
> solution above much nicer.
What do you expect to see with non-JSON messages? All-json being "{}" or the
message content (e.g. for a startup message, it would be
"{ "msg": "[origin software=\"rsyslogd\" swVersion=\"7.2.4\" x-pid=\"2705\"
x-info=\"http:\/\/www.rsyslog.com\"] start" }"
I ask because the latter is the case, and I think this has been introduced as
part of the lumberjack effort within the last three to six month.
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
