<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div><br>
</div>
<div> when I read your email I immediately thought about some confgen block, where systemd handled as an exception, and syslog-ng can "do the rest" with a system block in the else branch. (I checked it, confgen block runs first, so a generated "system()" block
will be expanded later by syslog-ng.)</div>
<div><br>
</div>
<div> But I thought this must be the "insane idea" you referred to earlier 🙂 So I waited a little, maybe someone on the mailing list has a better option.</div>
<div><br>
</div>
In the meantime, I also checked the code of the system() source, maybe we can add an additional parameter. Unfortunately there was a design choice earlier, where we handle all unknown parameters as "app-parser" parameters, so the "pass everything" part will
not work in this case. At this point, I could hardly imagine any solution without breaking legacy behavior, but I am open to any suggestion.<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Laci</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Fabien Wernli <wernli@in2p3.fr><br>
<b>Sent:</b> Wednesday, July 29, 2020 14:38<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] journald prefix</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
<br>
Hi,<br>
<br>
I'm in the process of simplifying my structured logging config.<br>
Most of my systems now have journald shipping local logs to syslog-ng via<br>
the `system()` auto-expanding source.<br>
<br>
While this is convenient, as it makes it possible to use the same config for<br>
all my systems (systemd and rest of world), it also makes it impossible to<br>
configure the underlying driver's defaults.<br>
<br>
The task at hand is shipping the journald additional fields, which would be<br>
easy to do using the following excerpt from the documentation:<br>
<br>
source s_journald {<br>
systemd-journal(prefix(".SDATA.journald."));<br>
};<br>
<br>
This is not possible of course using `system()`.<br>
I've got a couple of ideas on how to handle this, but I'd like to hear<br>
other (probably less insane than my own) ways first :-)<br>
<br>
Cheers<br>
<br>
</div>
</span></font></div>
</body>
</html>