<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Furthermore to my previous email looks like the substitution does not work in the ES destination options.<div class=""><br class=""></div><div class="">Instead in a file destination works perfectly.</div><div class=""><br class=""></div><div class=""><div class="">destination d_json {</div><div class=""> file("/var/log/json.log" template(t_sonicwall));</div><div class="">};</div></div><div class=""><br class=""></div><div class="">Marco</div><div><br class=""><blockquote type="cite" class=""><div class="">On 31 Jan 2018, at 11:26, Marco Mignone <<a href="mailto:info@marcomignone.com" class="">info@marcomignone.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Fabien,<div class="">Ok after some deeper investigation I have found out the following:</div><div class=""><br class=""></div><div class=""><b class="">template t_sonicwall</b> {<br class=""> template("$(format-json --scope all-nv-pairs --exclude MESSAGE,SOURCE,src.data,dst.data,cfield,nfield,mfield,fw.ip)");<br class="">};<br class=""><br class="">## DESTINATIONS ##<br class=""><br class="">destination d_elasticsearch {<br class=""> elasticsearch2(<br class=""> #client-lib-dir("/jarfiles/")<br class=""> client-lib-dir("/jarfiles/*.jar:/usr/lib/syslog-ng/3.13/java-modules/elastic-jest-client/*.jar:/usr/lib/syslog-ng/3.13/java-modules/")<br class=""> index("fw")<br class=""> # index("fw-${YEAR}.${MONTH}.$(lowercase '${.classifier.class}')")<br class=""> type("syslog")<br class=""> #time-zone("UTC")<br class=""> client_mode("http")<br class=""> cluster("tst-docker-cluster")<br class=""> #cluster_url("<a href="http://192.168.32.100:9200/" class="">http://192.168.32.100:9200</a>")<br class=""> cluster_url("<a href="http://tst-es6:9200/" class="">http://tst-es6:9200</a>")<br class=""> skip-cluster-health-check("yes")<br class=""> <b class="">template(t_sonicwall)</b><br class=""> flush-limit("1")<br class=""> );<br class="">};</div><div class=""><br class=""></div><div class="">The template substitution in the destination does not seem to work - in the packet capture I can see syslog-ng sending just ’t_sonicwall’ as a string instead of replacing that with the template defined in the config file.</div><div class="">If in the destination I put the full line:</div><div class=""> template("$(format-json --scope all-nv-pairs --exclude MESSAGE,SOURCE,src.data,dst.data,cfield,nfield,mfield,fw.ip)");</div><div class=""> </div><div class="">Things works correctly and a proper JSON object is sent to ES.</div><div class="">In my config file I tried both <b class="">template(t_sonicwall) and </b> <b class="">template(“t_sonicwall”) </b>as I am never sure what goes in quotes and what doesn’t.</div><div class=""><br class=""></div><div class="">I am not sure if this is a bug or just something wrong with the Docker image of syslog-ng - weird I am the only one experiencing this?</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Marco</div></div></div></blockquote></div><br class=""></body></html>