<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Try this:<br>
columns("datetime varchar(16)", "host varchar(32)", "program
varchar(16)", "pid varchar(4) default null", "message varchar")<br>
values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSG")<br>
indexes("datetime", "host", "program", "pid", "message")<br>
null(""));<br>
<br>
null(): If the content of a column matches the string specified in
the <em class="parameter"><code>null()</code></em> parameter, the
contents of the column will be replaced with an SQL NULL value<br>
<br>
It worked for me:<br>
<br>
Incoming log entry; line='<166>Feb 22 08:38:59 Vpxa:
HostChanged Event Fired, properties changed []'<br>
Running SQL query; query='INSERT INTO t2105010221cdb33661c82e91cb0b
(datetime, host, program, pid, message) VALUES (\'Feb 22 11:50:17\',
\'thor-t410\', \'Vpxa\', NULL, \'HostChanged Event Fired, properties
changed []\')'<br>
<br>
Ofc, you can use integer type for pid, but this is a string and not
an integer.<br>
<br>
On 2011-02-22 10:57, Hendrik Visage wrote:
<blockquote
cite="mid:AANLkTimn9jyWqRZE-hdMN3a27ULowLBtw-ya=4kAt7Ei@mail.gmail.com"
type="cite">Hi there,<br>
<br>
Okay, looks like I was looking/thinking about something else, so
lets explain my problem.<br>
<br>
I want the pid inseted to be a "proper" number/integer, not a
string/character, and the fun starts with several of my sources
not having a pid entry, thus that field I would like to be filled
with NULL values. However, it still gets escaped, and when it gets
escaped, the NULL is not null anymore, but the string 'NULL' :(<br>
<br>
I was hoping that in some why I could coerce syslog-ng to
understand that that column is a integer column, thus should not
be escaped as it is currently done ;(<br>
<br>
I have the following destination:<br>
destination d_pgsql {<br>
sql(type(pgsql)<br>
host("127.0.0.1") username("logwriter") password("logwriter")
port("5432")<br>
database("syslog")<br>
table("logs_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}") #or whatever
you want, example ${HOST}" for hosts, ${LEVEL}" for levels.. etc<br>
columns("datetime varchar(16)", "host varchar(32)", "program
varchar(16)", "pid varchar(8) default null", "message varchar")<br>
values("$R_DATE", "$HOST", "$PROGRAM", "${PID:-NULL}", "$MSG")<br>
indexes("datetime", "host", "program", "pid", "message"));<br>
};<br>
<br>
and the following log lines:<br>
<br>
Incoming log entry; line='<166>Feb 22 08:38:59 Vpxa:
[2011-02-22 08:38:59.862 1B7A7B90 verbose \'App\']
[VpxaHalServices] HostChanged Event Fired, properties changed []'<br>
Running SQL query; query='INSERT INTO logs_somedevice_20110222
(datetime, host, program, pid, message) VALUES (\'Feb 22
11:39:27\', \'somedevice\', \'Vpxa\', \'NULL\', \'[2011-02-22
08:38:59.862 1B7A7B90 verbose \'\'App\'\'] [VpxaHalServices]
HostChanged Event Fired, properties changed []\')'<br>
<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
</body>
</html>