On the wire or in files? In files, you are jn complete control with the template option.

On the wire you can set .SDATA.meta.sequenceId to an empty string, that should drop the sdata if I remember correctly.

But why do you want to do this?

On Mar 27, 2014 6:41 PM, "Ou, Jimmy" <Jimmy.Ou@viasat.com> wrote:

Hello,

 

I am having problem removing the structured data in the syslog message.

 

My test logs show the following:

<113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - - [meta sequenceId=”16”] @cee:[{“host”:”10.1.1.1”}]

 

I want it to look like the following without the sequenceId tag:

<113>1 2014-11-25T11:00:00+00:00 10.1.1.1 RedBox - - - @cee:[{“host”:”10.1.1.1”}]

 

Is there an option to turn this meta data off?

 

Thanks,

Jimmy

 


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq