<div dir="ltr">Hi,<div><br></div><div>Thanks for all suggestions. But, I solved the problem doing such hacking creating a new parser() as the below sample.<br></div><div><br></div><div>...............</div><div><div>rewrite p_my_key {</div><div>    set("${Key}", value("my_key"), condition("${Key}" != ""));</div><div>    set("${key}", value("my_key"), condition("${key}" != ""));</div><div>};<br></div></div><div class="gmail_extra">............</div><div class="gmail_extra"><div style="color:rgb(0,0,0);font-size:12.8px">destination d_my_log {</div><div style="color:rgb(0,0,0);font-size:12.8px">    file("/var/logs/myapp/${<span style="font-size:small;color:rgb(34,34,34)">my_key</span><span style="font-size:12.8px">:-invalid_key}.log"  template(t_raw2json)  );</span></div><div style="color:rgb(0,0,0);font-size:12.8px">};</div><div><div class="gmail-m_-9075822439614394973gmail_signature"><div dir="ltr"><br></div><div dir="ltr">--</div><div dir="ltr"><div>Jorge Pereira</div></div></div></div>
<br><div class="gmail_quote">On Wed, Jan 11, 2017 at 7:06 AM, Fekete, Róbert <span dir="ltr"><<a href="mailto:robert.fekete@balabit.com" target="_blank">robert.fekete@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Oh, right. Well, you could make an extra round of formatting+parsing, like incoming-message>format-json>l<wbr>owercase-the-formatted-json>js<wbr>on-parser>format-json, but that would not be too efficient performance-wise.<div>Or maybe you could use the lowercase function on the incoming message, depending on what it is like.</div></div><div class="gmail-m_-9075822439614394973HOEnZb"><div class="gmail-m_-9075822439614394973h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 11, 2017 at 9:46 AM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>On Wed, Jan 11, 2017 at 09:39:48AM +0100, Fekete, Róbert wrote:<br>
> Actually, in the docs we mention a 'lowercase' template function, I think<br>
> algernon wrote it a few years ago, you can give it a try.<br>
<br>
</span>But that will not let you munge the keys, unfortunately<br>
<div class="gmail-m_-9075822439614394973m_1437541413351309774HOEnZb"><div class="gmail-m_-9075822439614394973m_1437541413351309774h5"><br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=syslog<wbr>-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div>
</div></div><br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div></div>