On Thu, 16 Jul 2015, Joe Blow wrote:
Hey folks,
I had a question about mmjsonparse i was hoping you folks could help me
with. I have a slice of the message which is always perfect json (
%msg:50:8192% ).
Is there any way to pass mmjsonparse a slice of %msg%, instead of the %msg%?
The use case is so we can do : if $!JsonValueA == blah , send here, else
send there.
it can't be done currently with mmjsonparse (which doesn't actually accept
perfect json, it needs @cee: in front of the json), but the git version of
liblognorm used by mmnormalize lets you pass it any variable, not just the
entire message, and can parse JSON
so you would do
$template mytemplate,"%msg:50:$%"
set !.myvar = exec_template("mytemplate");
action(type="mmnormalize" path="$!extracted" variable="$.myvar"
ruleBase="/etc/getjson")
and /etc/getjson would be
rule=:%json:json%
and this would create the tree $!extracted!json!<stuff> for you to work with.
Rainer is doing a LOT of work on liblognorm right now and is planning a release
fairly soon (before he goes on vacation), there are a LOT of new parsers
available and he's working on an even more drastic set of improvements in the
flexibility of the library.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
