Don't know about this particular output module but in general what you
want is for rsyslog to parse the message and insert it as json object.
So you need to use parse_json() function on the input string and then
use proper template which will render the json to appropirate string. I
use similar approach (without the parsing part) to create output json
for Splunk's HEC input - the idea is roughly the same.
On 3.10.2022 18:35, Marcin Mirosław via rsyslog wrote:
Maybe when I show examples from mongo it will be more clear.
> db.log2.find()
[
{ _id: ObjectId("633b0ea6b8f2a532cfa6c64c"), msg: '{"foo":"bar"}' },
{ _id: ObjectId("633b0eb6b8f2a532cfa6c64d"), foo: 'bar' }
]
First record shows how msg is inserted to mongo by rsyslog. Second
record is what I would like to get.
rsyslog do:
db.log2.insert({msg:'{"foo":"bar"}'})
but I'd like to have:
db.log2.insert({"foo":"bar"})
Marcin
W dniu 03.10.2022 o 17:36, Rainer Gerhards pisze:
I do not fully understand the question (maybe language issue on my
side), but there is a syntax error:
In a string template, properties must be enclosed in percent sign. so:
... string="%msg%
HTH
Rainer
El lun, 3 oct 2022 a las 13:18, Marcin Mirosław via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
Hello!
Field msg contains complete json with data. I would like to instert it
to mongodb as is. But now rsyslog inserts it as a value of key "msg".
So now is:
msg: '{"foo":"bar"}
a i'd like to insert: only:
'{"foo","bar"}'
I tried with template:
template(name="ui-json" type="string" string="%msg")
but it doesn't do what I need. Is it possible to configure it using
template or this is imposible due to ommnongodb limitation?
Marcin Mirosław
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
