IMHO this is a JSON question, not rsyslog. But iirc it is \"
Rainer
Sent from phone, thus brief.
Tan Mientras via rsyslog <rsyslog@lists.adiscon.com> schrieb am Mo., 6.
März 2023, 12:36:
> Hi
>
> Receiving the following log:
>
> 2023-03-06T12:30:19+00:00 mycomputer windows/windows: {
> "event_id":"7036","event_number":"23135", "eventlog":"System",
> "source":"Service Control Manager", "source_message":"Windows module
> instaler entered in state "*stopped*".","category_id":"0","category":"",
> "computer":"mycomputer", "computer_ip":"192.168.0.2", "user":"" }
>
> json parsing fails as it contains unescaped " (enclosing stopped)
> Same happens when message contains unescaped \, like in domain\account
>
> hoy could I escape the colons or backslashes ?
> So far I have tried:
> set $!msg=replace($!msg,"\"","\\\"");
> set $!source_message=replace($!source_message,"\"","\\\"");
> set $!msg=replace($!msg!source_message,"\"","\\\"");
> without any success.
>
> Thanks
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
