Hi,

   I am using the 'format-json' as my below snip.

template t_raw2json {

    template("$(format-json --scope selected_macros \

                            --exclude TAGS          \

                            --exclude DATE          \

                            --exclude PRIORITY      \

                            --exclude FACILITY      \

                            --exclude PROGRAM

    )\n");

};

but, the problem is because sometimes I receive a jSON packet as { "Key": "value" } or {"key": "value}".... this has been a problem to my filter.

e.g:

destination d_nginx_modsec_log {

    file("/var/logs/myapp//${j.key:-invalid_key}.log"  template(t_raw2json)  );

};

Question: is it possible to normalize the jSON keys to lowercase? or someone has other approaches?

--

Jorge Pereira

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq