[syslog-ng] Writing a null character at the end of TCP payload

Gergely Nagy algernon at balabit.hu
Mon Aug 11 09:01:29 CEST 2014

Balazs Scheidler <bazsi77 at gmail.com> writes:

> I would prefer the creation of $(format-gelf) which would solve both the
> NUL issue and makes it easier for someone else to create GELF output.

FWIW, since there is no GELF C library out there, I started hacking on
one (which would also support chunking, and would provide an API we can
plug into LogWriter, so we won't have to make it a
LogThreadedDestDriver). It will take a while to finish it, because I'm
playing with getting the API right.

> Or alternatively, add an option to $(format-json) to add a suffix (and
> perhaps a prefix) in front of and after the resulting string. That would be
> useful for other purposes as well, and then $(format-gelf) could be
> implemented by my latest patches that enable the definition of template
> functions within the configuration file.
> E.g.
> template-function "format-gelf" "$(format-json --suffix "\x0" <format-json
> arguments to produce gelf>)"
> destination d_graylog {
>     network("" transport(tcp) template("$(format-gelf)"); };
> };

How about $(char 0) as a template function? That can be reused outside
of format-json.


More information about the syslog-ng mailing list