<div dir="ltr"><div dir="ltr"><div dir="ltr">Nevermind! I think I got it :-)<div><br></div><div><div><b>log {</b></div><div><b> source {</b></div><div><b> file('/var/log/audit/audit.log' flags(no-parse));</b></div><div><b> };</b></div><div><b> parser {</b></div><div><b> linux-audit-parser(prefix(".auditd."));</b></div><div><b> };</b></div><div><b> parser {</b></div><div><b> grouping-by(</b></div><div><b> key("${.auditd.msg}")</b></div><div><b> aggregate(</b></div><div><b> value(".auditd.test" "#########TEST")</b></div><div><b> )</b></div><div><b> timeout(10)</b></div><div><b> );</b></div><div><b> };</b></div><div><b> destination {</b></div><div><b> file('/tmp/test.json' template("$(format-json .auditd.exe .auditd.cwd .auditd.a* .auditd.test .auditd.success .auditd.pid .auditd.msg)\n"));</b></div><div><b> };</b></div><div><b>};</b></div></div><div><b><br></b></div><div>This seems to work as now result looks like this:</div><div><br></div><div><div><b>{</b></div><div><b> "_auditd": {</b></div><div><b> "test": "#########TEST",</b></div><div><b> "success": "yes",</b></div><div><b> "pid": "57483",</b></div><div><b> "msg": "audit(1604412718.657:211575):",</b></div><div><b> "exe": "/usr/bin/jq",</b></div><div><b> "cwd": "/etc/syslog-ng/conf.d",</b></div><div><b> "auid": "1000",</b></div><div><b> "argc": "1",</b></div><div><b> "arch": "c000003e",</b></div><div><b> "a3": "fffffffffffff878",</b></div><div><b> "a2": "564235a17dd0",</b></div><div><b> "a1": "564235a20680",</b></div><div><b> "a0": "jq"</b></div><div><b> }</b></div><div><b>}</b></div></div><div><b><br></b></div><div>If you have any improvements ideas please let me know.</div><div><br></div><div>Thanks!</div><div>Maciej</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">wt., 3 lis 2020 o 14:30 Maciek Solnicki <<a href="mailto:msolnicki@gmail.com">msolnicki@gmail.com</a>> napisał(a):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi Fabien,</div><div dir="ltr"><br></div><div dir="ltr">Thanks for your response.<div><br></div><div>I was using this snippet of code (taken from documentation) before, but doesn't seem to work either:</div><div><br></div><div><div><b>value("MESSAGE" "$(format-json .auditd.*)")</b></div><div><b><br></b></div><div>So how do I output an aggregated message to the test.json file ? Or any file.<b><br></b></div><div><br></div></div><div>I apologize if my questions are basic, but I had a hard time finding answers in documentation. Grouping-by() function could definitely use more explanation.</div><div><br></div><div>Kind regards</div><div>Maciej</div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">wt., 3 lis 2020 o 13:05 Fabien Wernli <<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>> napisał(a):<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Maciek,<br>
<br>
On Tue, Nov 03, 2020 at 12:24:40PM +0100, Maciek Solnicki wrote:<br>
> * destination {*<br>
> * file('/tmp/test.json' template("$(format-json .auditd.*)\n"));*<br>
> * };*<br>
> *};*<br>
<br>
This means you're outputting the contents of all `.auditd.` macros to file<br>
test.json.<br>
<br>
But your grouping-by parser generates a message with the macro MESSAGE set<br>
to the value "TEST" :<br>
<br>
> * grouping-by(*<br>
> * key("${.auditd.msg}")*<br>
> * timeout(10)*<br>
> * aggregate(value("MESSAGE" "TEST"))*<br>
> * );*<br>
<br>
So you won't see it in test.json.<br>
Well, more exactly you should see it as the default value of<br>
aggregate(inherit-mode()) is "context", but you won't see the MESSAGE:TEST<br>
macro as you're omitting it from your output.<br>
I'm guessing you should see a message twice in that case.<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>
</blockquote></div>