Oh, right. Well, you could make an extra round of formatting+parsing, like incoming-message>format-json>lowercase-the-formatted-json>json-parser>format-json, but that would not be too efficient performance-wise. Or maybe you could use the lowercase function on the incoming message, depending on what it is like. On Wed, Jan 11, 2017 at 9:46 AM, Fabien Wernli <wernli@in2p3.fr> wrote:
On Wed, Jan 11, 2017 at 09:39:48AM +0100, Fekete, Róbert wrote:
Actually, in the docs we mention a 'lowercase' template function, I think algernon wrote it a few years ago, you can give it a try.
But that will not let you munge the keys, unfortunately
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq