This is a huge oversight. I have "complained" about this before. A JSON
source (json parser) should append all of the tags from the JSON payload
into the current set of TAGS.

I'm not sure about syslog protocol (new RFC) if the TAGS is prepended
with the .SDATA if the syslog parser will populate the TAGS. I would
hope so.

Evan.

On 09/02/2015 12:00 AM, Fabien Wernli wrote:
> Hi Balázs,
>
> On Wed, Sep 02, 2015 at 07:16:32AM +0200, Scheidler, Balázs wrote:
>> The best solution to send dara over the wire between two Syslog-ng
>> instances (e.g. the one getting the logs and the other storing them in
>> elastic) is to use json to encode name-value pairs.
> That's another way, indeed. What these have in common, though, is that there
> is no way to transmit TAGS from one syslog-ng instance to another properly
> (then use tags() filters on the remote end)
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq