I've ran into an issue with ReplaceText on another thread but thought I'd move this over to it's own.
What I have is a syslog entry from OpenStack that contains CADF (Cloud Audit Data Federation) JSON as the payload. In the context of OpenStack these are login/security events that we'd like to see outside of a normal syslog stream and passed directly over to the security team. I'd started down the path of ExtractText and pulling out the associated JSON into an attribute but found when I wired in a ReplaceText and tried to replace the content with the attribute 3 copies of the JSON data were written to the file content. What I've since learned is I can just replace the text in place without yanking into an attribute. However, I can see cases where I might want to replace/append text using one or more attributes. Wanted to see if other have handled this differently and if there is an enhancement request in the offing? I put the template I was working from, with a line of the syslog data, up on GitHub in case anyone wants to see this behavior in action. You just have to play with turning processors on/off when viewing the full bulletin board. https://github.com/cj-wilson/NiFi-Templates Thanks in advance. -Chris
