[syslog-ng] 3.4 how to feed json object into syslog-ng with TAGS

[Evan Rempel]

I have a situation where syslog-ng processes a syslog line, users paserdb and does
lots of work and finally sends the complete object via json to an external application.
This application does some thinking and based on some other data sources
needs to send the log message back into syslog-ng with a different set of TAGS
so that it gets routed through syslog-ng to a different destination program.

The problem I am having is that syslog-ng does not use the TAGS in the incoming
json object. The TAGS get replaced with the TAGS on the "source" of the syslog-ng that
reads the json object, and augmented with any patterndb processing.

Can anyone think of a way to get some arbitrary set of TAGS (possibly in a different custom macro)
placed into the TAGS macro so that all of  the filters on tags can be used.

For example, I could make a patterndb for each individual tag value, and invoke each
patterndb on the MyTags value. If there is a match then tag the message with the TAG.
I would need to know all of the TAGS in advance and would probably not perform all that well,
but it would work.


Thanks in advance for any other suggestions.


-- 
Evan Rempel                                      erempel at uvic.ca
Senior Systems Administrator                        250.721.7691
Data Centre Services, University Systems, University of Victoria