<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">I'm relatively new to RFC5424 and was
under the impression that all of the syslog-ng parsed values
could/should be sent using the<br>
structured data mechanism. This should apply to all macros, not
just TAGS.<br>
<br>
In general, what I am proposing is that any "work" done by
syslog-ng on one computer, should be able to be maintained as the
event gets passed<br>
to another syslog-ng computer. The work should not be lost just
because the payload has moved from one system to another.<br>
<br>
I was hoping to use the syslog-ng pattern database to parse
messages at the source, matching source ip addresses, user names
etc.<br>
and forward that vi RFC5424 to a syslog-ng system that would then
feed elastic search, passing all of the parsed values to elastic
search for indexing.<br>
If that could not be done by RFC5424, I could use a raw JSON
payload, and unwrap it at the receiving end, however, the source
HOST, TAGS, DATE, TIME etc<br>
are all lost in this case as well.<br>
<br>
For the json parser, I think it would be good to have some kind of
option for permitting core macros to be replaced/overwritten.<br>
In the case of TAGS, which is a little bit special in the json
object because it is converted to a string, rather than a json
list, it should be appended to.<br>
<br>
Evan.<br>
<br>
<br>
On 09/03/2015 09:42 PM, Scheidler, Balázs wrote:<br>
</div>
<blockquote
cite="mid:CANWQT2NTyy5OFsvHs+z=DgrBYfKqV-=D3o5ewfLk1B1npiBGNQ@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<p dir="ltr">you are right, it is a huge oversight. can you pls
suggest an on wire format how this should work?</p>
<p dir="ltr">-- <br>
Bazsi</p>
<div class="gmail_quot<blockquote class=" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">This is a huge
oversight. I have "complained" about this before. A JSON<br>
source (json parser) should append all of the tags from the JSON
payload<br>
into the current set of TAGS.<br>
<br>
I'm not sure about syslog protocol (new RFC) if the TAGS is
prepended<br>
with the .SDATA if the syslog parser will populate the TAGS. I
would<br>
hope so.<br>
<br>
Evan.<br>
<br>
On 09/02/2015 12:00 AM, Fabien Wernli wrote:<br>
> Hi Balázs,<br>
><br>
> On Wed, Sep 02, 2015 at 07:16:32AM +0200, Scheidler,
Balázs wrote:<br>
>> The best solution to send dara over the wire between
two Syslog-ng<br>
>> instances (e.g. the one getting the logs and the other
storing them in<br>
>> elastic) is to use json to encode name-value pairs.<br>
> That's another way, indeed. What these have in common,
though, is that there<br>
> is no way to transmit TAGS from one syslog-ng instance to
another properly<br>
> (then use tags() filters on the remote end)<br>
><br>
>
______________________________________________________________________________<br>
</div>
</blockquote>
<br>
</body>
</html>