Thanks a lot for the quick reply! I'll investigate this and explore all the alternatives.
Best regards, Klearchos -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Thursday, December 08, 2016 10:35 PM To: rsyslog-users <[email protected]> Subject: Re: [rsyslog] rsyslog input in json format On Thu, 8 Dec 2016, Chaloulos, Klearchos (Nokia - GR/Athens) wrote: > Hello, > > Is it possible for rsyslog to receive messages over TCP in plain json format? > > I have looked through the documentation and the closest match I found for > supplying json-formatted messages was to put the json message as the payload > of a syslog message with the "@cee:" tag added, send the syslog message to > rsyslog over imtcp and then use the mmjsonparse module to parse the json > message. > > Is there a better alternative? In current versions you can skip the @cee: tag by setting cookie="" in the mmjsonparse action() call. If you want to send raw json without a header, you can use mmnormalize to parse the raw message as json I recommend still sending the syslog header and have the msg portion be json, the info in the header is something that you really do want to have for every message, and it really does need to be in a consistant location, so why not put it in the header? David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
