Hello, This is should work on 3.16.1, it is an *old* feature. On Tue, Mar 5, 2019 at 7:14 AM Ronald Fenner <rfenner@gamecircus.com> wrote:

Thanks I see how that can work now.

Does it require 3.20 or can I use this in 3.16?

Ronald Fenner Network Architect Game Circus LLC.

rfenner@gamecircus.com

On Mar 5, 2019, at 12:08 AM, Péter, Kókai <peter.kokai@oneidentity.com> wrote:

Hello,

You could use rewrite rule for this, but in fact macro expansion is capable to solve your problem: `${.cake:-no-cake}` where if `.cake` exists uses its value, otherwise the string after `:-`

@version: 3.20

log { source { stdin(flags(no-parse)); }; parser { kv-parser(prefix(".")); }; rewrite { set("[${.cake:-no-cake}]" value("MESSAGE")); }; #destination { file("/dev/stdout" template("${.cake:-undefined}\n")); }; destination { file("/dev/stdout"); }; };

As the result you could either use rewrite/set to add the value to the msg itself (other destination/parser/filter could use it), or you could just use it directly in the destination macro expansion. It really depends on your setup which place you should prefer.

-- Kokan

On Tue, Mar 5, 2019 at 12:56 AM Ronald Fenner <rfenner@gamecircus.com> wrote:

...

I generate a Kafka topic to send the message to by doing: topic("${topic}.${environment}") What I'd like to do if the field wasn't in the json message to provide a default value.

Im looking for like a tertiary operator to use In the topic or perhaps a rewrite rule.

I see the conditional expressions but from the docs it doesn't look like I can use it in the topic or a rewrite rule NOTE: My messages are json stings that get parsed and then imploded back to json as it's sent.

Thanks

Ronald Fenner Network Architect Game Circus LLC.

rfenner@gamecircus.com

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq