<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks I see how that can work now.<div class=""><br class=""></div><div class="">Does it require 3.20 or can I use this in 3.16?</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-position: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">Ronald Fenner</div><div class="">Network Architect</div><div class="">Game Circus LLC.</div></div><div class=""><br class=""></div><div class=""><a href="mailto:rfenner@gamecircus.com" class="">rfenner@gamecircus.com</a></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Mar 5, 2019, at 12:08 AM, Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" class="">peter.kokai@oneidentity.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class="">Hello,<div class=""><br class=""></div><div class="">You could use rewrite rule for this, but in fact macro expansion is capable to solve your problem: `${.cake:-no-cake}` where if `.cake` exists uses its value, otherwise the string after `:-`</div><div class=""><br class=""></div><div class=""><div class="">@version: 3.20</div><div class=""><br class=""></div><div class="">log {</div><div class=""> source { stdin(flags(no-parse)); };</div><div class=""> parser { kv-parser(prefix(".")); };</div><div class=""> rewrite { set("[${.cake:-no-cake}]" value("MESSAGE")); };</div><div class=""> #destination { file("/dev/stdout" template("${.cake:-undefined}\n")); };</div><div class=""> destination { file("/dev/stdout"); };</div><div class="">};</div></div><div class=""><br class=""></div><div class="">As the result you could either use rewrite/set to add the value to the msg itself (other destination/parser/filter could use it), or you could just use it directly in the destination macro expansion.</div><div class="">It really depends on your setup which place you should prefer.</div><div class=""><br class=""></div><div class="">--</div><div class="">Kokan</div><div class=""><br class=""></div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 5, 2019 at 12:56 AM Ronald Fenner <<a href="mailto:rfenner@gamecircus.com" class="">rfenner@gamecircus.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow-wrap: break-word;" class=""><div class=""><br class=""></div>I generate a Kafka topic to send the message to by doing: <span style="background-color:rgb(35,37,37);color:rgb(169,183,198);font-family:Menlo;font-size:9pt" class="">topic("${topic}.${environment}")</span><div class="">What I'd like to do if the field wasn't in the json message to provide a default value. </div><div class=""><br class=""></div><div class="">Im looking for like a tertiary operator to use In the topic or perhaps a rewrite rule.</div><div class=""><br class=""></div><div class="">I see the conditional expressions but from the docs it doesn't look like I can use it in the topic or a rewrite rule</div><div class="">NOTE: My messages are json stings that get parsed and then imploded back to json as it's sent.</div><div class=""><br class=""></div><div class="">Thanks</div><div class=""><br class=""></div><div class="">
<div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class=""><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class=""><div style="font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;" class=""><div class=""><div class="">Ronald Fenner</div><div class="">Network Architect</div><div class="">Game Circus LLC.</div></div><div class=""><br class=""></div><div class=""><a href="mailto:rfenner@gamecircus.com" target="_blank" class="">rfenner@gamecircus.com</a></div></div></div></div>
</div>
<br class=""></div>______________________________________________________________________________<br class="">
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank" class="">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br class="">
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank" class="">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br class="">
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank" class="">http://www.balabit.com/wiki/syslog-ng-faq</a><br class="">
<br class="">
</blockquote></div>
______________________________________________________________________________<br class="">Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" class="">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br class="">Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" class="">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br class="">FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" class="">http://www.balabit.com/wiki/syslog-ng-faq</a><br class=""><br class=""></div></blockquote></div><br class=""></div></body></html>