<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Just a note that the documentation contains format-json and
format_json too. I guess the format-json should be used.<br>
<br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<table class="admon" summary="Example: Using the format-json
template function" style="border-style: initial; border-image:
initial; width: 1273px; border-top-width: 0px; border-top-color:
rgb(19, 53, 129); border-bottom-width: 0px; border-bottom-color:
rgb(19, 53, 129); border-left-width: 0px; border-left-color:
rgb(19, 53, 129); border-right-width: 0px; border-right-color:
rgb(19, 53, 129); border-style: initial; font-family: 'Times New
Roman'; letter-spacing: normal; orphans: 2; text-indent: 0px;
text-transform: none; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); " border="0">
<tbody>
<tr>
<th class="admonheader" style="border-top-width: 1px;
border-right-width: 1px; border-bottom-width: 1px;
border-left-width: 1px; border-top-color: rgb(19, 53, 129);
border-right-color: rgb(19, 53, 129); border-bottom-color:
rgb(19, 53, 129); border-left-color: rgb(19, 53, 129);
border-style: initial; border-image: initial; padding-top:
5px; padding-right: 5px; padding-bottom: 5px; padding-left:
5px; background-color: rgb(255, 255, 255); font-family:
Arial, Helvetica, sans-serif; font-weight: bold; "
align="left">Example 11.3. Using the format-json template
function</th>
</tr>
<tr>
<td class="admontext" style="font-family: Arial, Helvetica,
sans-serif; font-size: 12px; border-top-width: 1px;
border-right-width: 1px; border-bottom-width: 1px;
border-left-width: 1px; border-top-color: rgb(19, 53, 129);
border-right-color: rgb(19, 53, 129); border-bottom-color:
rgb(19, 53, 129); border-left-color: rgb(19, 53, 129);
border-style: initial; border-image: initial; padding-top:
5px; padding-right: 5px; padding-bottom: 5px; padding-left:
5px; " align="left" valign="top">
<p style="font-family: Arial, Helvetica, sans-serif;
font-size: 12px; color: rgb(0, 0, 0); text-align: justify;
line-height: 14px; ">The following example selects every
available information about the log message, except for
the date-related macros (<em class="parameter"><code>R_*</code></em><span
class="Apple-converted-space"> </span>and<span
class="Apple-converted-space"> </span><em
class="parameter"><code>S_*</code></em>), selects the<span
class="Apple-converted-space"> </span><em
class="parameter"><code>.SDATA.meta.sequenceId</code></em><span
class="Apple-converted-space"> </span>macro, and defines
a new value-pair called<span class="Apple-converted-space"> </span><em
class="parameter"><code>MSGHDR</code></em><span
class="Apple-converted-space"> </span>that contains the
program name and PID of the application that sent the log
message.</p>
<pre class="synopsis" style="font-family: Courier, fixed; font-size: 12px; background-color: rgb(224, 224, 224); color: rgb(0, 0, 0); ">$(format-json --scope syslog,all_macros,selected_macros \
--exclude R_* --exclude S_* --key .SDATA.meta.sequenceId \
--pair MSGHDR="$PROGRAM[$PID]: ")</pre>
<p style="font-family: Arial, Helvetica, sans-serif;
font-size: 12px; color: rgb(0, 0, 0); text-align: justify;
line-height: 14px; ">The following example shows how to
use this template function to store log messages in JSON
format:</p>
<pre class="synopsis" style="font-family: Courier, fixed; font-size: 12px; background-color: rgb(224, 224, 224); color: rgb(0, 0, 0); ">destination d_json {
file("/var/log/messages.json" template("$(format_json --scope selected_macros --scope nv_pairs)"));
};</pre>
</td>
</tr>
</tbody>
</table>
<br>
<br>
On 12/21/2011 02:15 PM, Balazs Scheidler wrote:
<blockquote cite="mid:1324473310.15133.44.camel@bzorp" type="cite">
<pre wrap="">On Wed, 2011-12-21 at 03:25 -0500, Patrick Hemmer wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Sent: Wed Dec 21 2011 03:19:38 GMT-0500 (EST)
From: VÁMOS Balázs <a class="moz-txt-link-rfc2396E" href="mailto:vamos.balazs@zuriel.hu"><vamos.balazs@zuriel.hu></a>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>
Subject: [syslog-ng] Can I put all the parsed fields into a
destination template?
</pre>
<blockquote type="cite">
<pre wrap="">Hi,
I would like to forward the parsed fields to LOGalyze in an unstructured
way. Is it possible to create a serialized object (JSON or something
like that) after parsing message with patterndb?
</pre>
</blockquote>
<pre wrap="">Take a look at the format-json function, might be what youre after.
<a class="moz-txt-link-freetext" href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/index.html-single.html#template-function-format-json">http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/index.html-single.html#template-function-format-json</a>
</pre>
</blockquote>
<pre wrap="">
Yup, this should be $(format-json).
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
VÁMOS Balázs
ZURIEL Kft.
</pre>
</body>
</html>