Hi,
I am using the 'format-json' as my below snip.
template t_raw2json {
template("$(format-json --scope selected_macros \
--exclude TAGS \
--exclude DATE \
--exclude PRIORITY \
--exclude FACILITY \
--exclude PROGRAM
)\n");
};
but, the problem is because sometimes I receive a jSON packet as { "Key": "value" } or {"key": "value}".... this has been a problem to my filter.
e.g:
destination d_nginx_modsec_log {
file("/var/logs/myapp//${j.key:-invalid_key}.log" template(t_raw2json) );
};
Question: is it possible to normalize the jSON keys to lowercase? or someone has other approaches?