I've tested this using the sources from https://github.com/rsyslog/rsyslog/tree/v8-stable-es-fix and applying the patch.
We use now "set $!@timestamp = ..." and kibana is reading and using the new variable. Thank you. On Tue, Aug 19, 2014 at 12:34 PM, Rainer Gerhards <[email protected]> wrote: > I have crafted a patch to permit @: > > > https://github.com/rsyslog/rsyslog/commit/32da92474821fc24d0563864b11bca8a87cb5a7a > > I would appreciate if folks would try it out and report back. > > Thx, > Rainer > > > On Tue, Aug 12, 2014 at 10:58 AM, Cristian Falcas <[email protected] > > > wrote: > > > I have opened https://github.com/rsyslog/rsyslog/issues/110 as a future > > request. > > > > Thank you > > > > > > On Tue, Aug 12, 2014 at 10:31 AM, Rainer Gerhards < > > [email protected]> > > wrote: > > > > > Sent from phone, thus brief. > > > Am 12.08.2014 03:12 schrieb "David Lang" <[email protected]>: > > > > > > > > On Tue, 12 Aug 2014, Cristian Falcas wrote: > > > > > > > >> Hello, > > > >> > > > >> I can't find any way to set a field with name "@timestamp" in a json > > > >> template. > > > >> > > > >> Did anyone managed to set fields with non-ascii names? > > > >> > > > >> My conf is something like this: > > > >> template(name="es_template" type="subtree" subtree="$!") > > > >> set $!timestamp = $timereported; > > > >> set $!timegenerated = %timegenerated; > > > >> > > > >> and I would like to set it to this: > > > >> set $!@timestamp = $timereported; > > > > > > > > > > > > I think variables need to start with a letter, but Rainer would need > to > > > comment on this. > > > > > > I need to check this with the code, but thats probably true. If so, i > > guess > > > its not hard to permit @. > > > > > > Rainer > > > > > > > > David Lang > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
