Gergely,

Thank you. It seems that the syntax of value_pairs->scope and format_json->scope are not completely the same.
However the documentation of format_json refers to value_pairs.

http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/concepts-value-pairs.html

A working config for me is:

destination d_json{
file(
"/var/log/messages.json"
template("$(format_json --scope all-nv-pairs --scope core)\n")
);
};

Quoted list of scopes is syntactically wrong.

Balazs

On 02/03/2012 11:34 AM, Gergely Nagy wrote:

Vámos Balázs <vamos.balazs@zuriel.hu> writes:

Error message in log:
error in template: $(format-json --scope soft-macros)

There is no soft-macros scope, only selected-macros. The list of known
scopes is:

nv-pairs, dot-nv-pairs, all-nv-pairs, rfc3164 (also aliased to core and
base), rfc5424 (also aliased to syslog-proto), all-macros,
selected-macros, sdata and everything.

As for separating scopes.. as far as I see, you need to use spaces, and
quote the scope list: $(format-json --scope "all-macros sdata")

I haven't tested this yet, though, and perhaps adding support for using
a comma-separated list would be reasonable. But I'm not too keen on
doing that, as --scope is something that I don't like all that much..