[syslog-ng] Rationale for json TAGS not being a json array?

Evan Rempel erempel at uvic.ca
Wed May 16 00:28:32 CEST 2012


Before I report a bug/feature change I would like to ask if there was any reason that
the JSON output for multi-value items simply joins them with a comma rather than
turning them into a JSON array.

Most notably the TAGS field is put out by format-json shows something like;

"TAGS": ".source.patterndb,.classifier.cluster,.net.connected"

where these are autopoluated by the patterndb

.source.patterndb,.classifier.cluster

and this one is added by a specific tabs entry in my patterndb.

         <tags>
           <tag>.net.connect</tag>
         </tags>



-- 
Evan Rempel


More information about the syslog-ng mailing list