<div dir="ltr">Hello,<div><br></div><div>This is should work on 3.16.1, it is an *old* feature.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 5, 2019 at 7:14 AM Ronald Fenner <<a href="mailto:rfenner@gamecircus.com">rfenner@gamecircus.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow-wrap: break-word;">Thanks I see how that can work now.<div><br></div><div>Does it require 3.20 or can I use this in 3.16?</div><div><br><div>
<div style="color:rgb(0,0,0);font-family:Helvetica;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-east-asian:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="color:rgb(0,0,0);font-family:Helvetica;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-east-asian:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="color:rgb(0,0,0);font-family:Helvetica;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-east-asian:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div><div>Ronald Fenner</div><div>Network Architect</div><div>Game Circus LLC.</div></div><div><br></div><div><a href="mailto:rfenner@gamecircus.com" target="_blank">rfenner@gamecircus.com</a></div></div></div></div>
</div>
<div><br><blockquote type="cite"><div>On Mar 5, 2019, at 12:08 AM, Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>> wrote:</div><br class="gmail-m_-2633192778902131905Apple-interchange-newline"><div><div dir="ltr"><div dir="ltr">Hello,<div><br></div><div>You could use rewrite rule for this, but in fact macro expansion is capable to solve your problem: `${.cake:-no-cake}` where if `.cake` exists uses its value, otherwise the string after `:-`</div><div><br></div><div><div>@version: 3.20</div><div><br></div><div>log {</div><div> source { stdin(flags(no-parse)); };</div><div> parser { kv-parser(prefix(".")); };</div><div> rewrite { set("[${.cake:-no-cake}]" value("MESSAGE")); };</div><div> #destination { file("/dev/stdout" template("${.cake:-undefined}\n")); };</div><div> destination { file("/dev/stdout"); };</div><div>};</div></div><div><br></div><div>As the result you could either use rewrite/set to add the value to the msg itself (other destination/parser/filter could use it), or you could just use it directly in the destination macro expansion.</div><div>It really depends on your setup which place you should prefer.</div><div><br></div><div>--</div><div>Kokan</div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 5, 2019 at 12:56 AM Ronald Fenner <<a href="mailto:rfenner@gamecircus.com" target="_blank">rfenner@gamecircus.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div><br></div>I generate a Kafka topic to send the message to by doing: <span style="background-color:rgb(35,37,37);color:rgb(169,183,198);font-family:Menlo;font-size:9pt">topic("${topic}.${environment}")</span><div>What I'd like to do if the field wasn't in the json message to provide a default value. </div><div><br></div><div>Im looking for like a tertiary operator to use In the topic or perhaps a rewrite rule.</div><div><br></div><div>I see the conditional expressions but from the docs it doesn't look like I can use it in the topic or a rewrite rule</div><div>NOTE: My messages are json stings that get parsed and then imploded back to json as it's sent.</div><div><br></div><div>Thanks</div><div><br></div><div>
<div style="font-family:Helvetica;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-east-asian:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="font-family:Helvetica;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-east-asian:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div style="font-family:Helvetica;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-variant-east-asian:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><div><div>Ronald Fenner</div><div>Network Architect</div><div>Game Circus LLC.</div></div><div><br></div><div><a href="mailto:rfenner@gamecircus.com" target="_blank">rfenner@gamecircus.com</a></div></div></div></div>
</div>
<br></div>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
______________________________________________________________________________<br>Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br><br></div></blockquote></div><br></div></div>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>