Not right now, but value-pairs does support key transformations (add-prefix and friends), and the same way lowercasing could happen there.

However, someone needs to come up with an implementation, as right now, I don't see when I could get to it.

The required code is in lib/value-pairs/transforms.c, and then its parsing needs to be added to both the cmdline parser (lib/value-pairs/cmdline.c) and the grammar (vp_rekey_options in cfg-grammar.y)

HTH,

Bazsi

--
Bazsi

On Wed, Jan 11, 2017 at 12:03 AM, Jorge Pereira <jpereiran@gmail.com> wrote:

Hi,

   I am using the 'format-json' as my below snip.

template t_raw2json {

    template("$(format-json --scope selected_macros \

                            --exclude TAGS          \

                            --exclude DATE          \

                            --exclude PRIORITY      \

                            --exclude FACILITY      \

                            --exclude PROGRAM

    )\n");

};

but, the problem is because sometimes I receive a jSON packet as { "Key": "value" } or {"key": "value}".... this has been a problem to my filter.

e.g:

destination d_nginx_modsec_log {

    file("/var/logs/myapp//${j.key:-invalid_key}.log"  template(t_raw2json)  );

};

Question: is it possible to normalize the jSON keys to lowercase? or someone has other approaches?

--

Jorge Pereira

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq