On 07/15/2013 09:37 PM, David Lang wrote:
On Mon, 15 Jul 2013, Erik Steffl wrote:
Here's what I'm trying to do:
receive cee message, put it into a json data structure and forward
the whole thing to another server.
input: <135> time host tag @cee{"orignal":"message"}
output: <135> time host tag @cee{"cluster":"someName", "message":
{"original":"message"}}
So what I did was:
set $!myClusterName = "someName";
then use these as part of the template:
constant(value="\"cluster\":{")
property("$!myClusterName")
...
constant(value="\"message\":")
property("$!all-json")
and it almost works but $!myClusterName becomes part of the
$!all-json. Looked at docs but it seems all variables that are set
using set keyword become part of $!all-json.
using property("msg") also sort of works but it includes @cee (which
I don't think makes sense in that part of message, it's already all
json).
Any way to get $!all-json without the custom variables or "msg"
property without @cee? Or should I be forwarding it in some entirely
different way?
what if you just do something like:
set $!cluster = "somename";
won't this include the 'cluster:"somename"' string inside the all-json
string?
yes it will but I want exact opposite :) I am trying to not change
the original message (it might have a field named "cluster" already) or
it might not even be a cee json message etc. (I can figure out whether
the message is json formatted or not but I have to set the variables
before that since I need them no matter what the format it)
trying to achieve something like (as described above but this might
be more obvious), pseudo code follows:
set $!message = $!all-json
set $!cluster = "clusterName"
after the two lines above the $!all-json has two fields - "message"
where the value is original $!all-json and cluster, where the value is
my variable (which of course does not work cause I (as far as I know)
don't have a way to set the variable without changing $all-json.
But only if the message is a cee message (otherwise it, of course
does not make sense). If it's not cee message then I still need cluster
name but $!all-json!message is just the original message string.
I.e. I am not trying to add info to the parsed message (that works,
discovered that during my failed attempts), I would like the intact
parsed message to become part of outgoing message.
Does that explain what I'm trying to do? Any ideas how to achieve that?
erik
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
