<p dir="ltr">Seems that jsonparser drops messages for some reason. I don&#39;t have the code handy but perhaps you could check the error cases.</p>
<p dir="ltr">It should report failures though.</p>
<div class="gmail_quote">On Jul 6, 2015 6:12 AM, &quot;Russell Fulton&quot; &lt;<a href="mailto:r.fulton@auckland.ac.nz">r.fulton@auckland.ac.nz</a>&gt; wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi<br>
<br>
Thanks to various folks I managed to build 3.7b2 with json.<br>
<br>
I am now trying to convert my ELSA config to produce a parsed output in json that I can feed into Elastic Search.<br>
<br>
Having failed to make my full config work (I had to try ;) so I tried a basic one based on<br>
<a href="https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/json-parser.html" rel="noreferrer" target="_blank">https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/json-parser.html</a><br>
<br>
[ Aside: minor syntax error on this page — lnside log {} you can not name parser elements ]<br>
<br>
here is my conf:<br>
<br>
@version: 3.7<br>
<br>
source s_json {     network(port(1514) flags(no-parse)); };<br>
<br>
destination d_json {    file(&quot;/data/russell/test.json”         template(&quot;$(format-json --scope dot-nv-pairs)\n&quot;)); };<br>
<br>
log {<br>
    source(s_json);<br>
    parser  {        json-parser (prefix(&quot;.json.&quot;));    };<br>
    destination(d_json);<br>
};<br>
<br>
<br>
I get no output and ‘stats’ shows:<br>
<br>
[rful011@secmgrprd01 ~]$ sudo /usr/local/syslog-ng/sbin/syslog-ng-ctl stats<br>
SourceName;SourceId;SourceInstance;State;Type;Number<br>
src.none;;;a;processed;0<br>
src.none;;;a;stamp;0<br>
source;s_json;;a;processed;19375<br>
global;payload_reallocs;;a;processed;25710<br>
global;msg_clones;;a;processed;0<br>
destination;d_json;;a;processed;0<br>
center;;queued;a;processed;0<br>
global;sdata_updates;;a;processed;0<br>
center;;received;a;processed;19375<br>
global;internal_queue_length;;a;processed;19378<br>
<br>
Which is the same as I get with my full config with lots of patterns.<br>
<br>
As usual am missing something basic!<br>
<br>
<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>