Oh wait. I didn't correctly see that on the phone: can you try "json" as property name. Maybe that's the problem. It would still be a bug but that would be a workaround.
Sent from phone, thus brief. Am 26.05.2015 21:58 schrieb "Rainer Gerhards" <[email protected]>: > Then that segfault smells like a bug. I suggest opening a bug tracker on > github. I can't look immediately as I have a larger call with a support > customer but will look as soon as possible. > > Sent from phone, thus brief. > Am 26.05.2015 21:54 schrieb "David Boles (dboles)" <[email protected]>: > >> Umberlog generates the cee cookie fine and mmjsonparse slurps up the >> payload just fine. The problem is that umberlog only lets one embed flat >> name/value pairs into the original message. I'm processing JSON data to >> recover the hierarchy that I flattened to pass through umberlog. >> >> In your previous email you said: >> >> > Msg is a text property thus it will never be interpreted as json. If I >> > looked correctly you need to set $! >> >> That was my thought as well, but if instead of my mmexternal script doing: >> >> print json.dumps({ 'msg' : <data> }) >> >> I do >> >> print json.dumps({ '$!' : <data> }) >> >> then rsyslogd suffers a segmentation fault. If in /etc/rsyslogd.conf I >> try to set a field within $! to the modified data and then try to use a >> template referencing $!, rsyslogd also suffers a segmentation fault. >> >> >> >> -----Original Message----- >> From: [email protected] [mailto: >> [email protected]] On Behalf Of Rainer Gerhards >> Sent: Tuesday, May 26, 2015 2:27 PM >> To: rsyslog-users >> Subject: Re: [rsyslog] Using mmexternal ... >> >> Side note: doesn't umberlog generate json with the proper cee cookie so >> that it can be directly consumed? >> >> Sent from phone, thus brief. >> Am 26.05.2015 21:03 schrieb "David Boles (dboles)" <[email protected]>: >> >> > I've corrected a problem with what I sent out a couple of days ago and >> > can programmatically alter the log data. However, I still have the >> > following >> > questions: >> > >> > (1) When the data is loaded into mongodb via ommongodb I get records >> > like >> > this: >> > >> > { >> > "_id" : ObjectId("5564bfafa8a87859b34ad450"), >> > "msg" : "{ >> > \"msg\": \"[umberlog test] testing ... 1, 2, 3\\n\", >> > \"host\": \"test0\", >> > \"elements\": [ >> > { \"type\": \"ladybug\", \"name\": \"natalie\", >> > \"spots\": 12 }, >> > { \"role\": \"worker\", \"age\": 9, \"type\": >> > \"ant\", >> > \"name\": \"B289\" } >> > ], >> > \"time\": \"2015-05-26T13:47:11.110216-05:00\" }" >> > } >> > >> > How can I make the body of msg be JSON as opposed to a string >> > containing JSON? >> > >> > >> > (2) Why can I not access $! in a template (this is related to the >> > first >> > question) >> > after using mmexternal? >> > >> > All of this references code in: >> > >> > https://github.com/davidboles/snowflake.git >> > >> > Perhaps when working this sample could go on your Wiki as an example >> > of using rsyslog with Lumberjack structured log data. >> > >> > Thanks, >> > >> > David Boles >> > >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >> > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > DON'T LIKE THAT. >> > >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: >> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites >> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >> THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
