(replies inline) On Wed, 08 Apr 2020, David Lang wrote:
> > what you could do is to use the replace function to replace the $ with some > other character > > set $.msgcopy = replace($msg, "$", "_"); > > then you can use mmnormalize to parse $.msgcopy with a rule like > rule=:%.:json% > (I don't remember if mmjsonparse got the ability to parse other variables or > if > it's a matter of moving to the more general mmnormalize This is an interesting approach I hadn't considered, thanks for the idea. The downside in this specific case that all `$` instances in the msg would be replaced, which could cause the message to be malformed. I might be able to get away with replacing the `$id` key entirely however which is an interesting thought to explore I'll keep tinkering :) Cheers -- GitHub: https://github.com/rtyler GPG Key ID: 0F2298A980EE31ACCA0A7825E5C92681BEF6CEA2
signature.asc
Description: OpenPGP digital signature
_______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
