or are you saying you want something like
a b c
to be able to result in json like
{foo:a bar:{baz1:b baz2=c}}
If it's the latter, I've had a request in for years to add a function that would
let you configure mmnormalize to put things into a variable named bar!baz1 and
then run this function to change this from a string with a ! in it (that rsyslog
could not address) to a multi-layer structure
David Lang
On Wed, 11 Dec 2019, David Lang via rsyslog wrote:
Date: Wed, 11 Dec 2019 11:15:37 -0800 (PST)
From: David Lang via rsyslog <[email protected]>
To: Marian Bobrik via rsyslog <[email protected]>
Cc: David Lang <[email protected]>
Subject: Re: [rsyslog] rsyslog, parsing by mmnormalize to nested JSON
On Sun, 8 Dec 2019, Marian Bobrik via rsyslog wrote:
HI,
please can someone share liblognorm rulebase to parser a string to nested
JSON e.g.
"server=localhost.localdomain" parse to { "host" : { "hostname" :
"localhost.localdomain" }}
I'm not sure exactly what you are looking for (an example of the source
string would help a lot)
but the approach that I would do is to parse the main message, then parse the
variable that the json ends up in
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
