Umberlog generates the cee cookie fine and mmjsonparse slurps up the payload
just fine. The problem is that umberlog only lets one embed flat name/value
pairs into the original message. I'm processing JSON data to recover the
hierarchy that I flattened to pass through umberlog.
In your previous email you said:
> Msg is a text property thus it will never be interpreted as json. If I
> looked correctly you need to set $!
That was my thought as well, but if instead of my mmexternal script doing:
print json.dumps({ 'msg' : <data> })
I do
print json.dumps({ '$!' : <data> })
then rsyslogd suffers a segmentation fault. If in /etc/rsyslogd.conf I try to
set a field within $! to the modified data and then try to use a template
referencing $!, rsyslogd also suffers a segmentation fault.
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 26, 2015 2:27 PM
To: rsyslog-users
Subject: Re: [rsyslog] Using mmexternal ...
Side note: doesn't umberlog generate json with the proper cee cookie so that it
can be directly consumed?
Sent from phone, thus brief.
Am 26.05.2015 21:03 schrieb "David Boles (dboles)" <[email protected]>:
> I've corrected a problem with what I sent out a couple of days ago and
> can programmatically alter the log data. However, I still have the
> following
> questions:
>
> (1) When the data is loaded into mongodb via ommongodb I get records
> like
> this:
>
> {
> "_id" : ObjectId("5564bfafa8a87859b34ad450"),
> "msg" : "{
> \"msg\": \"[umberlog test] testing ... 1, 2, 3\\n\",
> \"host\": \"test0\",
> \"elements\": [
> { \"type\": \"ladybug\", \"name\": \"natalie\",
> \"spots\": 12 },
> { \"role\": \"worker\", \"age\": 9, \"type\":
> \"ant\",
> \"name\": \"B289\" }
> ],
> \"time\": \"2015-05-26T13:47:11.110216-05:00\" }"
> }
>
> How can I make the body of msg be JSON as opposed to a string
> containing JSON?
>
>
> (2) Why can I not access $! in a template (this is related to the
> first
> question)
> after using mmexternal?
>
> All of this references code in:
>
> https://github.com/davidboles/snowflake.git
>
> Perhaps when working this sample could go on your Wiki as an example
> of using rsyslog with Lumberjack structured log data.
>
> Thanks,
>
> David Boles
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
