<div dir="ltr">P.S. Sorry for not adding a subject :( I guess it's too late now...</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div>--</div><div>Performance Monitoring * Log Analytics * Search Analytics</div>
<div><span style="font-family:arial,sans-serif;font-size:13px">Solr & Elasticsearch Support * </span><a href="http://sematext.com/" style="font-size:13px;font-family:arial,sans-serif" target="_blank">http://sematext.com/</a></div>
</div></div>
<br><br><div class="gmail_quote">On Fri, Jul 18, 2014 at 7:57 PM, Radu Gheorghe <span dir="ltr"><<a href="mailto:radu.gheorghe@sematext.com" target="_blank">radu.gheorghe@sematext.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi,<div><br></div><div>This is my first post here, so I have to start by thanking all the contributors for an awesome product :)</div><div><br></div><div>My question is about adding an array to a JSON document. What I'm trying to do is to send a message like this:</div>
<div><br></div><div>@cee: {"message": "test message", "tags":["test", "message"]}</div><div><br></div><div>My template looks a like this:</div><div><br></div><div>template("@cee: $(format-json --pair message=\"$MSG\" --pair tags="test")\n")<br>
</div><div><br></div><div>This works fine for a single tag, but how can I add multiple ones?</div><div><br></div><div>The broader use-case is that I want to add tags to logs matching a specific filter. For example:</div>
<div>
----------------------</div><div><div>filter user_tests { facility(user) and message(test) };</div><div><br></div><div>destination logsene_tests {</div><div> syslog("<a href="http://logsene-receiver-syslog.sematext.com" target="_blank">logsene-receiver-syslog.sematext.com</a>"</div>
<div> transport("tcp")</div><div> port(514)</div><div> template("@cee: $(format-json --pair message=\"$MSG\" --pair tags=\"test\")\n")<br></div><div> );</div><div>
};</div></div><div><br></div><div>log { source(all_syslog); filter(user_tests); destination(logsene_tests); flags(final); };<br></div><div><div>----------------------</div><div></div></div><div><br></div><div>If there's a better way to add multiple tags to a log, please tell me - I'm good with making big changes if it leads to a cleaner/better config.</div>
<div><br></div><div>Best regards,</div><div>Radu</div><div><div><div dir="ltr"><div>--</div><div>Performance Monitoring * Log Analytics * Search Analytics</div><div><span style="font-family:arial,sans-serif;font-size:13px">Solr & Elasticsearch Support * </span><a href="http://sematext.com/" style="font-size:13px;font-family:arial,sans-serif" target="_blank">http://sematext.com/</a></div>
</div></div>
</div></div>
</blockquote></div><br></div>