Gergely, Thank you. It seems that the syntax of value_pairs->scope and format_json->scope are not completely the same. However the documentation of format_json refers to value_pairs. http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guide... A working config for me is: destination d_json{ file( "/var/log/messages.json" template("$(format_json --scope all-nv-pairs --scope core)\n") ); }; Quoted list of scopes is syntactically wrong. Balazs On 02/03/2012 11:34 AM, Gergely Nagy wrote:
Vámos Balázs <vamos.balazs@zuriel.hu> writes:
Error message in log: error in template: $(format-json --scope soft-macros) There is no soft-macros scope, only selected-macros. The list of known scopes is:
nv-pairs, dot-nv-pairs, all-nv-pairs, rfc3164 (also aliased to core and base), rfc5424 (also aliased to syslog-proto), all-macros, selected-macros, sdata and everything.
As for separating scopes.. as far as I see, you need to use spaces, and quote the scope list: $(format-json --scope "all-macros sdata")
I haven't tested this yet, though, and perhaps adding support for using a comma-separated list would be reasonable. But I'm not too keen on doing that, as --scope is something that I don't like all that much..