Hi,

Thanks for all suggestions. But, I solved the problem doing such hacking creating a new parser() as the below sample.

...............
rewrite p_my_key {
    set("${Key}", value("my_key"), condition("${Key}" != ""));
    set("${key}", value("my_key"), condition("${key}" != ""));
};
............
destination d_my_log {
    file("/var/logs/myapp/${my_key:-invalid_key}.log"  template(t_raw2json)  );
};

--
Jorge Pereira

On Wed, Jan 11, 2017 at 7:06 AM, Fekete, Róbert <robert.fekete@balabit.com> wrote:
Oh, right. Well, you could make an extra round of formatting+parsing, like incoming-message>format-json>lowercase-the-formatted-json>json-parser>format-json, but that would not be too efficient performance-wise.
Or maybe you could use the lowercase function on the incoming message, depending on what it is like.

On Wed, Jan 11, 2017 at 9:46 AM, Fabien Wernli <wernli@in2p3.fr> wrote:
On Wed, Jan 11, 2017 at 09:39:48AM +0100, Fekete, Róbert wrote:
> Actually, in the docs we mention a 'lowercase' template function, I think
> algernon wrote it a few years ago, you can give it a try.

But that will not let you munge the keys, unfortunately

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq



______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq