[syslog-ng] Fields don't appear on kibana.

[Evan Rempel]

This is a huge oversight. I have "complained" about this before. A JSON 
source (json parser) should append all of the tags from the JSON payload 
into the current set of TAGS.

I'm not sure about syslog protocol (new RFC) if the TAGS is prepended 
with the .SDATA if the syslog parser will populate the TAGS. I would 
hope so.

Evan.

On 09/02/2015 12:00 AM, Fabien Wernli wrote:
> Hi Balázs,
>
> On Wed, Sep 02, 2015 at 07:16:32AM +0200, Scheidler, Balázs wrote:
>> The best solution to send dara over the wire between two Syslog-ng
>> instances (e.g. the one getting the logs and the other storing them in
>> elastic) is to use json to encode name-value pairs.
> That's another way, indeed. What these have in common, though, is that there
> is no way to transmit TAGS from one syslog-ng instance to another properly
> (then use tags() filters on the remote end)
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>