escaped it would be
{"time":"2020-02-02T18:00:00", "mode":"imuxsock", "host":"venus", "msg":" {\"name\":\"bill\", \"address\":\"123 Anywhere\",
\"City\":\"Cleveland\", \"State\":\"Ohio\", \"zip\":\"12345\"}”}
David Lang
On Thu, 4 Feb 2021, John Chivian wrote:
Date: Thu, 4 Feb 2021 17:49:07 -0600
From: John Chivian <[email protected]>
To: rsyslog-users <[email protected]>
Cc: David Lang <[email protected]>
Subject: Re: [rsyslog] JSON extraction
David is correct. If what you posted is actually your input…
{"time":"2020-02-02T18:00:00", "mode":"imuxsock", "host":"venus", "msg":" {"name":"bill", "address":"123 Anywhere",
"City":"Cleveland", "State":"Ohio", "zip":"12345"}”}
…then you’re not likely to have much luck doing anything but a manual parse.
The input should like like this…
{"time":"2020-02-02T18:00:00", "mode":"imuxsock", "host":"venus", "msg": {"name":"bill", "address":"123 Anywhere",
"City":"Cleveland", "State":"Ohio", "zip":"12345”}}
…so that at least the structure is valid. If the intent is truly for the msg
object to be a string, not a JSON object, then you must escape the quotes
within it.
I would then argue that flattening the JSON object, such that the fields
within are part of the top level, is a loss definition not an improvement.
Regards,
On Feb 4, 2021, at 17:14, David Lang via rsyslog <[email protected]>
wrote:
mmjsonparse is a pretty specialized use case, I would suggest that you look at
mmnormalize, particularly the ability to parse variables.
note that the quotes would need escaping with your example, what you posted
isn't actually valid JSON.
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
