if you use user defined data types, they will nest the contents of the type
inside the type name.
that may work for you, depending on the layout of your data
David Lang
On Thu, 12 Dec 2019, Marian Bobrik via rsyslog wrote:
Date: Thu, 12 Dec 2019 07:12:14 +0100
From: Marian Bobrik via rsyslog <[email protected]>
To: rsyslog-users <[email protected]>
Cc: Marian Bobrik <[email protected]>
Subject: Re: [rsyslog] rsyslog, parsing by mmnormalize to nested JSON
yes, exactly, i need to construct structure with depth, either directly by
mmnormalize or later, as you wrote, by other function.
anyway i can do that by rewriting whole $! in rainerscript later, but this
is ugly.
thx
m.
On Thu, Dec 12, 2019 at 3:20 AM David Lang via rsyslog <
[email protected]> wrote:
or are you saying you want something like
a b c
to be able to result in json like
{foo:a bar:{baz1:b baz2=c}}
If it's the latter, I've had a request in for years to add a function that
would
let you configure mmnormalize to put things into a variable named bar!baz1
and
then run this function to change this from a string with a ! in it (that
rsyslog
could not address) to a multi-layer structure
David Lang
On Wed, 11 Dec 2019, David Lang via rsyslog wrote:
Date: Wed, 11 Dec 2019 11:15:37 -0800 (PST)
From: David Lang via rsyslog <[email protected]>
To: Marian Bobrik via rsyslog <[email protected]>
Cc: David Lang <[email protected]>
Subject: Re: [rsyslog] rsyslog, parsing by mmnormalize to nested JSON
On Sun, 8 Dec 2019, Marian Bobrik via rsyslog wrote:
HI,
please can someone share liblognorm rulebase to parser a string to
nested
JSON e.g.
"server=localhost.localdomain" parse to { "host" : { "hostname" :
"localhost.localdomain" }}
I'm not sure exactly what you are looking for (an example of the source
string would help a lot)
but the approach that I would do is to parse the main message, then
parse the
variable that the json ends up in
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
