https://www.rsyslog.com/doc/v8-stable/rainerscript/functions/rs-parse_json.html
<https://www.rsyslog.com/doc/v8-stable/rainerscript/functions/rs-parse_json.html>
The documentation is the best resource, but this list runs a close second.
The new syntax format makes configurations much clearer, and exposes some
functionality that the legacy syntax cannot.
set $.isJson = parse_json($msg, "\$!parsed");
if ($.isJson == 0) then {
set $!jsonmsg = $msg;
set $!strmsg = "";
} else {
set $!jsonmsg = "null";
set $!strmsg = $msg;
}
If parsing was successful, the content is contained in $!parsed. It’s not used
or referenced in the above example, but it could be.
Note that object identification (isJson or not) fails in some cases. Informal
research suggest this happens in some circumstances where strings begin with a
numeric character (especially a zero “0”) and are misidentified as objects.
Regards,
> On Jul 29, 2021, at 17:20, David Lang via rsyslog <[email protected]>
> wrote:
>
> a sample of the log you are trying to parse would help a lot.
>
> David Lang
>
> On Thu, 29 Jul 2021, Bill Schoolfield via rsyslog wrote:
>
>> Date: Thu, 29 Jul 2021 17:11:14 -0500
>> From: Bill Schoolfield via rsyslog <[email protected]>
>> To: [email protected]
>> Cc: Bill Schoolfield <[email protected]>
>> Subject: [rsyslog] Help with custom template and field for mysql output
>> Can anyone share an example config file for parsing json messages and
>> outputting them to a custom table (fields),
>>
>> Pertinent part of config that I've tried:
>>
>> $ModLoad ommysql
>>
>> module(load="mmjsonparse")
>>
>> template(name="StdSQLformat" type="list" option.sql="on") {
>> constant(value="insert into mylog (bxmsg, level)")
>> constant(value=" values ('")
>> property(name="%bxmsg%")
>> constant(value="', ")
>> property(name="%level%")
>> constant(value="')")
>> }
>>
>> local0.* action(type="mmjsonparse",template="StdSQLformat")
>>
>> local0.* :ommysql:127.0.0.1,mydb,myuser,mypass
>>
>>
>>
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
>> LIKE THAT.
>>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
