2015-11-21 14:48 GMT+01:00 Joe Blow <[email protected]>: > Anyone know the answer? I see a number of people who have had issues with > SQL like formatting and needed to do this, but I don't see a clear answer. > I'm using rsyslog to pump into ES, and would almost suggest a subroutine > not unlike this: > > def json_escape(istr): > json_chars = > [('\\','\\\\'),('/','\\/'),('\"','\\\"'),('\n','\\n'),('\r','\\r'),('\t','\\t'),('\x08','\\f'),('\x0c','\\b')] > for s, r in json_chars: > istr = istr.replace(s, r) > return istr > > Any ideas? I'm sure someone must have run into this before.
The escaping happens automatically when you define the property to be json. Have a look at this guide: http://blog.sematext.com/2013/07/01/recipe-rsyslog-elasticsearch-kibana/ HTH Rainer > > Cheers, > > JB > > On Fri, Nov 20, 2015 at 1:49 PM, Joe Blow <[email protected]> wrote: > >> I'm pretty sure this has been covered elsewhere, but I'm having a hard >> time finding any decent documentation on property replacement. It would be >> nice if we had a "replace 'this' with 'that'" example for within a >> property, say %rawmsg%. >> >> Does anyone know a good way of escaping backslashes? Is regex the only >> answer? If so what exactly does that look like? With all the ERE and >> colons beside each other in the docs, my eyes start going crossed. >> >> Cheers, >> >> JB >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
