<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-size:11.0pt" lang="EN-GB">> But, is it possible to do the opposite: read a json file and forward to a third server in syslog rfc5424 format?</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-size:11.0pt" lang="EN-GB"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-size:11.0pt" lang="EN-GB">Absolutely.</span> json-parser() can be used to parse JSON objects into name-value pairs:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<a href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/administration-guide/72#TOPIC-1431181" id="LPNoLP169300">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.26/administration-guide/72#TOPIC-1431181</a></div>
<br>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
You can then refer to the separated parts of the JSON message using the key of the JSON object as a macro.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-size:11.0pt" lang="EN-GB">RFC5424 can forward structured elements too, this part of the message is called "STRUCTURED-DATA".</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<span style="font-size:11.0pt" lang="EN-GB">If you add the ".SDATA." prefix to all important JSON fields, it will be automatically
</span>forwarded as <span style="font-size:11.0pt" lang="EN-GB">RFC5424</span> structured-data.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
For example:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
</div>
<span>log {<br>
</span>
<div> source { file("/tmp/jsoninput" flags(no-parse)); };<br>
</div>
<div> parser {<br>
</div>
<div> json-parser(prefix(".SDATA.example@32473.json."));<br>
</div>
<div> };<br>
</div>
<div> destination { syslog("host"); };<br>
</div>
<span>};</span>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
If you want to forward the original message (in JSON format), but with a proper <span style="font-size:11.0pt" lang="EN-GB">
RFC5424</span> header, you can just omit the json-parser() block.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Please note that RFC5424's SDATA has limitations: the name (key) of the sdata elements is limited to 32 characters:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<pre>SD-NAME = 1*32PRINTUSASCII
</pre>
</div>
<div>Fortunately, syslog-ng won't truncate those names for you, but your collector may not be able to parse it back correctly:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<a href="https://github.com/syslog-ng/syslog-ng/issues/3197" id="LPlnk265058">https://github.com/syslog-ng/syslog-ng/issues/3197</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
When receiving JSON messages, you have to deal with message separation, because JSON parsing is a separate parser step.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
For example, when reading from a file, you can use a basic file() source, if your JSON object is represented in a single line.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
In case you receive JSON payload from network, I recommend using the syslog() source. This way, multi-line JSON data won't be a problem.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
--</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
László Várady<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Carlos Lopez <clopmz@outlook.com><br>
<b>Sent:</b> Friday, May 22, 2020 8:59<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] Convert json format to syslog rfc5424</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif}
span.x_EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:12.0pt;
font-family:"Calibri",sans-serif}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.x_WordSection1
{}
-->
</style>
<div lang="en-ES" link="#0563C1" vlink="#954F72">
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt">Hi all,</span></p>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt">Due to some issues with our logs collector server, I need to read some logs in json format and convert them to syslog rfc5424 and forward to our central syslog server.</span></p>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt">Acctually, all information regarding this type of configuration located in syslog-ngs web site is related to send json format as a destination. But, is it possible to do the opposite: read
a json file and forward to a third server in syslog rfc5424 format? Yes, I will try to catch up only some specific fields, not all fields contained in the json soure file.</span></p>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt"> </span></p>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt">Any tips?</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt"> </span></p>
<div>
<p class="x_MsoNormal"><span lang="EN-GB" style="font-size:11.0pt; color:black">Regards,</span></p>
<p class="x_MsoNormal"><span style="font-size:11.0pt; color:black">C. L. Martinez
</span></p>
</div>
</div>
</div>
</div>
</body>
</html>