I am passing data from rsyslog to logstash and to pass on some special
fields I need to jsonencapsulate the data.
It is passed via syslog to logstash since this seems to be the only
format working at the moment.
My template looks like this:
$template
ls_json,"{%timereported:::date-rfc3339,jsonf:timestamp%,%source:::jsonf:@source_host%,\"@source\":\"syslog://%fromhost-ip:::json%\",\"@message\":\"%msg::::json%\",\"@fields\":{%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%,%fromhost:::jsonf%,%fromhost-ip:::jsonf%}}"
Not surprisingly it barfs when the msg field contains an double quote "
Is it possible to "pre-escape" the doublequote to be \" within the msg
field?
At least I assume that would be the easiest way to do it.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
