yes, exactly, i need to construct structure with depth, either directly by mmnormalize or later, as you wrote, by other function. anyway i can do that by rewriting whole $! in rainerscript later, but this is ugly.
thx m. On Thu, Dec 12, 2019 at 3:20 AM David Lang via rsyslog < [email protected]> wrote: > or are you saying you want something like > > a b c > to be able to result in json like > {foo:a bar:{baz1:b baz2=c}} > > If it's the latter, I've had a request in for years to add a function that > would > let you configure mmnormalize to put things into a variable named bar!baz1 > and > then run this function to change this from a string with a ! in it (that > rsyslog > could not address) to a multi-layer structure > > David Lang > > On Wed, 11 Dec 2019, David Lang via rsyslog wrote: > > > Date: Wed, 11 Dec 2019 11:15:37 -0800 (PST) > > From: David Lang via rsyslog <[email protected]> > > To: Marian Bobrik via rsyslog <[email protected]> > > Cc: David Lang <[email protected]> > > Subject: Re: [rsyslog] rsyslog, parsing by mmnormalize to nested JSON > > > > On Sun, 8 Dec 2019, Marian Bobrik via rsyslog wrote: > > > >> HI, > >> please can someone share liblognorm rulebase to parser a string to > nested > >> JSON e.g. > >> "server=localhost.localdomain" parse to { "host" : { "hostname" : > >> "localhost.localdomain" }} > > > > I'm not sure exactly what you are looking for (an example of the source > > string would help a lot) > > > > but the approach that I would do is to parse the main message, then > parse the > > variable that the json ends up in > > > > David Lang > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T > > LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
