<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Gergely,<br>
<br>
Thank you. It seems that the syntax of value_pairs->scope and
format_json->scope are not completely the same.<br>
However the documentation of format_json refers to value_pairs.<br>
<br>
<a
href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/concepts-value-pairs.html">http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/concepts-value-pairs.html</a><br>
<br>
A working config for me is:<br>
<br>
destination d_json{<br>
file(<br>
"/var/log/messages.json" <br>
template("$(format_json --scope all-nv-pairs --scope core)\n")<br>
);<br>
};<br>
<br>
Quoted list of scopes is syntactically wrong.<br>
<br>
<br>
Balazs<br>
<br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<br>
On 02/03/2012 11:34 AM, Gergely Nagy wrote:
<blockquote cite="mid:87obtg8atm.fsf@algernon.balabit" type="cite">
<pre wrap="">Vámos Balázs <a class="moz-txt-link-rfc2396E" href="mailto:vamos.balazs@zuriel.hu"><vamos.balazs@zuriel.hu></a> writes:
</pre>
<blockquote type="cite">
<pre wrap="">Error message in log:
error in template: $(format-json --scope soft-macros)
</pre>
</blockquote>
<pre wrap="">
There is no soft-macros scope, only selected-macros. The list of known
scopes is:
nv-pairs, dot-nv-pairs, all-nv-pairs, rfc3164 (also aliased to core and
base), rfc5424 (also aliased to syslog-proto), all-macros,
selected-macros, sdata and everything.
As for separating scopes.. as far as I see, you need to use spaces, and
quote the scope list: $(format-json --scope "all-macros sdata")
I haven't tested this yet, though, and perhaps adding support for using
a comma-separated list would be reasonable. But I'm not too keen on
doing that, as --scope is something that I don't like all that much..
</pre>
</blockquote>
<br>
</body>
</html>