<div dir="ltr">Actually, in the docs we mention a 'lowercase' template function, I think algernon wrote it a few years ago, you can give it a try. <div><a href="https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html">https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html</a><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 11, 2017 at 8:43 AM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>Not right now, but value-pairs does support key transformations (add-prefix and friends), and the same way lowercasing could happen there.<br><br></div>However, someone needs to come up with an implementation, as right now, I don't see when I could get to it.<br><br></div>The required code is in lib/value-pairs/transforms.c, and then its parsing needs to be added to both the cmdline parser (lib/value-pairs/cmdline.c) and the grammar (vp_rekey_options in cfg-grammar.y)<br><br></div>HTH,<br></div>Bazsi<br></div><div class="gmail_extra"><br clear="all"><div><div class="m_-4372553227382552989gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote"><div><div class="h5">On Wed, Jan 11, 2017 at 12:03 AM, Jorge Pereira <span dir="ltr"><<a href="mailto:jpereiran@gmail.com" target="_blank">jpereiran@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hi,<div><br></div><div> I am using the 'format-json' as my below snip.</div><div><br></div><div><div>template t_raw2json {</div><div> template("$(format-json --scope selected_macros \</div><div> --exclude TAGS \</div><div> --exclude DATE \</div><div> --exclude PRIORITY \</div><div> --exclude FACILITY \</div><div> --exclude PROGRAM</div><div> )\n");</div><div>};</div></div><div><br></div><div><br></div><div>but, the problem is because sometimes I receive a jSON packet as { "Key": "value" } or {"key": "value}".... this has been a problem to my filter.<br></div><div><br></div><div>e.g:</div><div><br></div><div><div>destination d_nginx_modsec_log {</div><div> file("/var/logs/myapp//${j.key<wbr>:-invalid_key}.log" template(t_raw2json) );</div><div>};</div><div><br></div><div>Question: is it possible to normalize the jSON keys to lowercase? or someone has other approaches?</div><div><div class="m_-4372553227382552989m_-5449665980174013260gmail_signature"><div dir="ltr">--<div>Jorge Pereira</div></div></div></div>
</div></div>
<br></div></div>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>