On Mon, 6 Apr 2015, Rainer Gerhards wrote:
2015-04-02 23:38 GMT+02:00 David Lang <[email protected]>:
On Thu, 2 Apr 2015, Rainer Gerhards wrote:
Sent from phone, thus brief.
Am 02.04.2015 23:15 schrieb "David Lang" <[email protected]>:
On Thu, 2 Apr 2015, Rainer Gerhards wrote:
Sent from phone, thus brief.
Am 02.04.2015 22:30 schrieb "David Lang" <[email protected]>:
I have a couple systems that are sending raw JSON, but I'm also looking
at interacting with logstash and nxlog systems, and they like to use raw
JSON on a TCP port
Do you know about the framing? Is it all one line?
in some cases yes, but not in all cases. When used as an input parser,
there would need to be an option to treat newlines like whitespace and
continue until the parser either completed or no longer matched. In some
cases the newlines are going to be in the content not just in the
whitespace around the JSON elements
Then it's more than just parsers, it's a different protocol.
fair, but a new protocol that uses a liblognorm parser can easily emulate
the existing line-based protocols (it can't do octet framing or two-way
things like RELP, but anything else should be able to work)
yeah, sure -- but I am hesitant to put all of these different things
into a single module. There "real" RFC protocols must be strict,
whereas the others are more heuristics like. Combining this into a
single code base calls for complexity and long term trouble.
BTW: I think this protocol-less JSON is GELF. I was asked a couple of
days if we could add it, and it looks exactly what you describe.
it sounds similar, but not exactly the same.
When sending to ElasticSearch, the more the data can be pre-parsed into JSON
variables, the better. GELF just has a single short message object.
In terms of receving messages, I would just parse and hold whatever variables
are defined in the JSON into the $! namespace, and populate the relevant
connection-based properties, leaving the rest blank.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
