Hi Luis, Try removing the quotes around the value, like:
constant(value="\",\"bytes\":") property(name="$!bytes" type="int") # next constant will probably begin with a (escaped) quote. Remove it, too. Alternatively, you can define the mapping for bytes in Elasticsearch upfront. If you're using daily (or other time-based) indices, you probably want to do that in a template. Here's a post that should provide some pointers: http://blog.sematext.com/2015/02/09/elasticsearch-mapping-types-for-json-logging/ But please let me know if you have further questions. Best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Wed, Apr 8, 2015 at 2:48 AM, Luis Londoño <[email protected]> wrote: > Hi All, > > I'm trying to remove quotes of a numeric value of a property using > type="int", but is not working for me in version rsyslog 8.8. > > Using the following line inside a template: > > constant(value="\",\"bytes\":\"") property(name="$!bytes" > type="int") > > the quotes remains in the field bytes in the elasticsearch request. > > Any ideas? > > Thanks in advance, > > Luis E. Londoño > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
