2013/1/8 Rainer Gerhards <[email protected]> > Radu, > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Radu Gheorghe > > Sent: Monday, January 07, 2013 3:47 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] Some list templates with mmjsonparse try to get > > 2GB of RAM or give OOM > > > > Wow, that was fast! Thanks, Rainer! > > > > Regarding the related questions: > > - please let me know if there's any issue with using $!all-json. I > > would > > need to use it to handle with CEE-enhanced and "regular" logs with the > > same > > template - and output a JSON. Something like: > > > > template(name="testTemplate" > > type="list") { > > constant(value="{") > > constant(value="\"@timestamp\":\"") > > property(name="timereported" dateFormat="rfc3339") > > constant(value="\",") > > property(name="$!all-json" position.from="2") > > } > > > > I can work around that with 2 templates and %parsesuccess%, but I find > > the > > solution above much nicer. > > > What do you expect to see with non-JSON messages? All-json being "{}" or > the message content (e.g. for a startup message, it would be > > "{ "msg": "[origin software=\"rsyslogd\" swVersion=\"7.2.4\" > x-pid=\"2705\" x-info=\"http:\/\/www.rsyslog.com\"] start" }" > > I ask because the latter is the case, and I think this has been introduced > as part of the lumberjack effort within the last three to six month. > > I'm expecting the message content as JSON. Which is supercool :) because I can treat non-JSON messages as if they were JSON with just the field "msg".
Best regards, Radu _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
