Hello, I have a log message in JSON format that needs to be written to the MongoDB database, such that I should be able to later query the database based on fields in the JSON record. However, when I try to use the syslog-ng mongodb destination driver using : destination d_mongodb { mongodb( servers("localhost:27017") database("syslog") collection("messages") value-pairs(key("MESSAGE")) ); }; The record appears in the mongodb database as: {"MESSAGE":<My JSON formatted message>} I do not want the MESSAGE macro to be part of the record in the database, I only want to it's JSON-encoded value to be entered in the database. Is this possible? Thanks in advance for your help. Regards, Raj -- Twitter: @Blismedia <http://twitter.com/#%21/blismobile> BlisMedia 32 Percy Street, London W1T 2DE www.blismedia.com <http://www.blismobile.com/> <http://www.blismobile.com/> [image: Follow on Twitter] <http://twitter.com/#%21/blismobile>[image: Blis Website] <http://www.blismobile.com/> This communication is from BlisMedia, which is a trading name of Breeze Tech (UK) Ltd, a company registered in England and Wales with registered number 06455773. Its registered office is 32 Percy Street, London W1T 2DE, United Kingdom. This communication contains information that is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please (1) notify info@blismedia.com<info@blismobile.com> by forwarding this email and delete all copies from your system and (2) note that disclosure, distribution, copying or use of this communication is strictly prohibited. Email communications cannot be guaranteed to be secure or free from error or viruses. All emails sent to or from a Blismobile email account are securely archived and stored by an external supplier. This email does not constitute a contractual agreement; such agreements are in specified contractual or Insertion Order (IO) form only and exclusively contain all the terms to which Breeze Tech )UK) Ltd will be bound. To the extent permitted by law, Breeze Tech (UK) Ltd does not accept any liability for use of or reliance on the contents of this email by any person save by the intended recipient(s) to the extent agreed in a contract or Insertion Order. Opinions, conclusions and other information in this email which have not been delivered by way of the business of Breeze Tech (UK) Ltd are neither given nor endorsed by it.
Rajalakshmi Iyer <raj@blismedia.com> writes:
Hello,
I have a log message in JSON format that needs to be written to the MongoDB database, such that I should be able to later query the database based on fields in the JSON record.
However, when I try to use the syslog-ng mongodb destination driver using :
destination d_mongodb { mongodb( servers("localhost:27017") database("syslog") collection("messages") value-pairs(key("MESSAGE")) ); };
The record appears in the mongodb database as:
{"MESSAGE":<My JSON formatted message>}
I do not want the MESSAGE macro to be part of the record in the database, I only want to it's JSON-encoded value to be entered in the database. Is this possible?
If I understand you correctly, you want to *parse* the JSON message, and put whatever fileds are in it, into MongoDB. That is not possible with syslog-ng 3.3, because it does not have a json parser (unless you backport it from 3.4, which isn't that hard, and I can help if so need be). With syslog-ng 3.4, you could do something along these lines: source s_json { tcp("0.0.0.0" port(8192) flags(no-parse)); }; parser p_json { json-parser(prefix(".json.")); }; destination d_mongodb { mongodb( servers("localhost:27017") database("syslog") collection("messages") value-pairs(key(".json.*" rekey(shift(6)))) ); }; log { source(s_json); parser(p_json); destination(d_mongodb); }; -- |8]
participants (2)
-
Gergely Nagy
-
Rajalakshmi Iyer