On Thu, 14 Apr 2016, Alan Scherger wrote:
I've read through the guide: http://www.rsyslog.com/tag/cee-enhanced/
I can't seem to get this example to work in the real world:
http://pastebin.com/AGPfCDgV
Adding or removing:
module(load="mmjsonparse")
*.* :mmjsonparse:
Seems to have zero impact, as it would seem it's imjournal is the one that
builds this json object?:
https://github.com/rsyslog/rsyslog/blob/v8.17.0/plugins/imjournal/imjournal.c#L207
https://github.com/rsyslog/rsyslog/blob/v8.17.0/runtime/msg.c#L4485
Thanks in advanced!
mmjsonparse takes log messages where the message is in the format:
@cee:{json}
and parses it, putting the result in the $! regular variable namespace. There is
an enhancement request in (I don't remember if it's going to make it in 8.18 or
not) to parse json in the message body without the @cee tag
various other modules can create data in the $! namespace (in some cases others
as well) and that data will show up when you do the various things
write the message out with the format RSYSLOG_DebugFormat and you will see
everything under $!, $. and $\ as well as the default namespaces
I think there may be problems with variable names that start with _ I seem to
remember seeing some patches around this and the imjournal module recently.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
