<div dir="ltr">Hi,<div><br></div><div>This is my first post here, so I have to start by thanking all the contributors for an awesome product :)</div><div><br></div><div>My question is about adding an array to a JSON document. What I'm trying to do is to send a message like this:</div>
<div><br></div><div>@cee: {"message": "test message", "tags":["test", "message"]}</div><div><br></div><div>My template looks a like this:</div><div><br></div><div>template("@cee: $(format-json --pair message=\"$MSG\" --pair tags="test")\n")<br>
</div><div><br></div><div>This works fine for a single tag, but how can I add multiple ones?</div><div><br></div><div>The broader use-case is that I want to add tags to logs matching a specific filter. For example:</div><div>
----------------------</div><div><div>filter user_tests { facility(user) and message(test) };</div><div><br></div><div>destination logsene_tests {</div><div> syslog("<a href="http://logsene-receiver-syslog.sematext.com">logsene-receiver-syslog.sematext.com</a>"</div>
<div> transport("tcp")</div><div> port(514)</div><div> template("@cee: $(format-json --pair message=\"$MSG\" --pair tags=\"test\")\n")<br></div><div> );</div><div>
};</div></div><div><br></div><div>log { source(all_syslog); filter(user_tests); destination(logsene_tests); flags(final); };<br></div><div><div>----------------------</div><div></div></div><div><br></div><div>If there's a better way to add multiple tags to a log, please tell me - I'm good with making big changes if it leads to a cleaner/better config.</div>
<div><br></div><div>Best regards,</div><div>Radu</div><div><div><div dir="ltr"><div>--</div><div>Performance Monitoring * Log Analytics * Search Analytics</div><div><span style="font-family:arial,sans-serif;font-size:13px">Solr & Elasticsearch Support * </span><a href="http://sematext.com/" style="font-size:13px;font-family:arial,sans-serif" target="_blank">http://sematext.com/</a></div>
</div></div>
</div></div>