[Bug 229] New: json parser does not maintain all json object data
https://bugzilla.balabit.com/show_bug.cgi?id=229 Summary: json parser does not maintain all json object data Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: erempel@uvic.ca Type of the Report: --- Estimated Hours: 0.0 Then the json parser is used parser p_json { json-parser(); }; log { source(mysource); parser(p_json); ... } tag-value pairs are not maintained if they are ones that are normally populated by syslog-ng. Even with a source that has flags(no-parse) man macros are populated by syslog-ng C_* S_* R_* YEAR_DAY YEAR WEEKDAY_NAME WEEK_DAY_ABBREV WEEK_DAY WEEKDAY WEEK USEC UNIXTIME TZOFFSET TZ TAGS SYSUPTIME STAMP SEC MSEC MONTH_WEEK MONTH_NAME MONTH_ABBREV MONTH MIN LOGHOST ISODATE HOUR12 HOUR FULLDATE DAY DATE AMPM the json parser should populate the macros after the initial population allowing the json data to overwrite/control all of the macros. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=229 --- Comment #1 from Balazs Scheidler <bazsi@balabit.hu> 2013-03-29 20:17:48 --- time related macros are derived from the timestamp of the message and not actually stored there as properties. thus these macros cannot be set directly, rather the timestamp needs to be set. each message has two timestamps: the one declared in the message (S_ prefix) and the reception time. the reception time is assigned by syslog-ng when the syslog-ng receives a message. the timestamp is parsed from the message, but defaults to reception time if it is not found. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=229 --- Comment #2 from Evan Rempel <erempel@uvic.ca> 2013-04-22 00:41:35 --- What I read from your response is that there are two properties that can be set with the json parser that will effectively change all of the S_ and R_ macros. What you did not state is what the names of these two properties are. Also, that still leaves TAGS as a macro that can not be passed in the json object and parsed correctly by the json parser. Do you think that these can be "fixed". -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=229 --- Comment #3 from Balazs Scheidler <bazsi@balabit.hu> 2013-04-30 15:14:15 --- (In reply to comment #2)
What I read from your response is that there are two properties that can be set with the json parser that will effectively change all of the S_ and R_ macros. What you did not state is what the names of these two properties are.
Also, that still leaves TAGS as a macro that can not be passed in the json object and parsed correctly by the json parser.
Do you think that these can be "fixed".
those are not real properties, the R_DATE is set based on the received timestamp, S_DATE can't be set right now, a separate parser would be needed for that. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=229 --- Comment #4 from Evan Rempel <erempel@uvic.ca> 2013-04-30 17:47:04 --- (In reply to comment #3)
Also, that still leaves TAGS as a macro that can not be passed in the json object and parsed correctly by the json parser.
those are not real properties, the R_DATE is set based on the received timestamp, S_DATE can't be set right now, a separate parser would be needed for that.
Thanks. That just leaves the discussion of the TAGS macro. The JSON parser should join all of the tags from the JSON object into the TAGS macro of the current log line. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com