W dniu 03.10.2022 o 18:55, Mariusz Kruk via rsyslog pisze:
Don't know about this particular output module but in general what you want is for rsyslog to parse the message and insert it as json object.
Meseems that now rsyslog put %msg% as json object. (
ex: msg: '{"foo":"bar"}' }
)
So you need to use parse_json() function on the input string and then use proper template which will render the json to appropirate string. I use similar approach (without the parsing part) to create output json for Splunk's HEC input - the idea is roughly the same.On 3.10.2022 18:35, Marcin Mirosław via rsyslog wrote:Maybe when I show examples from mongo it will be more clear. > db.log2.find() [ { _id: ObjectId("633b0ea6b8f2a532cfa6c64c"), msg: '{"foo":"bar"}' }, { _id: ObjectId("633b0eb6b8f2a532cfa6c64d"), foo: 'bar' } ]First record shows how msg is inserted to mongo by rsyslog. Second record is what I would like to get.rsyslog do: db.log2.insert({msg:'{"foo":"bar"}'}) but I'd like to have: db.log2.insert({"foo":"bar"}) Marcin W dniu 03.10.2022 o 17:36, Rainer Gerhards pisze:I do not fully understand the question (maybe language issue on my side), but there is a syntax error: In a string template, properties must be enclosed in percent sign. so: ... string="%msg% HTH Rainer El lun, 3 oct 2022 a las 13:18, Marcin Mirosław via rsyslog (<[email protected]>) escribió:Hello! Field msg contains complete json with data. I would like to instert it to mongodb as is. But now rsyslog inserts it as a value of key "msg". So now is: msg: '{"foo":"bar"} a i'd like to insert: only: '{"foo","bar"}' I tried with template: template(name="ui-json" type="string" string="%msg") but it doesn't do what I need. Is it possible to configure it using template or this is imposible due to ommnongodb limitation? Marcin Mirosław _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhardsNOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT._______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhardsNOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT._______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhardsNOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
