My application was sending empty pairs which would be passed on through syslog-ng. The first idea was having syslog-ng turn { "key1":"val1", "key2":"" } into { "key1":"val1" } Instead i've modified my service to validate every field before encoding the json string so it never sends empty fields to begin with. This solves the issue with my application but there may still be a use case for other applications where app-side validation is not an option. On Tue, May 22, 2018 at 3:38 AM, Scheidler, Balázs < balazs.scheidler@balabit.com> wrote:
Hi,
Hmm, it was a feature to handle zero length values properly, and at the same time I've added the unset() rewrite operation, which causes name-value pairs to be omitted.
It might make sense to add a --skip-empty-values or similar option to $(format-json), would that solve your problem? Can you elaborate your use-case?
Thanks
-- Bazsi
On Tue, May 22, 2018 at 7:50 AM, Nik Ambrosch <nik@ambrosch.com> wrote:
Hi - I'm trying to figure out how to instruct json-parser() to exclude empty (or nonexistent) json pairs from being passed to it's template. This is possible with the csv parser using null("") but not json.
It seems that if i specify all my json-parser() pairs using --pair example=\"${MYMACRO}\" the desired behavior is achieved, however using --scope nv-pairs instead will log the empty values.
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product= syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq