[syslog-ng] is it possible to normalize the jSON keys to lowercase?

[Scheidler, Balázs]

Not right now, but value-pairs does support key transformations (add-prefix
and friends), and the same way lowercasing could happen there.

However, someone needs to come up with an implementation, as right now, I
don't see when I could get to it.

The required code is in lib/value-pairs/transforms.c, and then its parsing
needs to be added to both the cmdline parser (lib/value-pairs/cmdline.c)
and the grammar (vp_rekey_options in cfg-grammar.y)

HTH,
Bazsi

-- 
Bazsi

On Wed, Jan 11, 2017 at 12:03 AM, Jorge Pereira <jpereiran at gmail.com> wrote:

> Hi,
>
>    I am using the 'format-json' as my below snip.
>
> template t_raw2json {
>     template("$(format-json --scope selected_macros \
>                             --exclude TAGS          \
>                             --exclude DATE          \
>                             --exclude PRIORITY      \
>                             --exclude FACILITY      \
>                             --exclude PROGRAM
>     )\n");
> };
>
>
> but, the problem is because sometimes I receive a jSON packet as { "Key":
> "value" } or {"key": "value}".... this has been a problem to my filter.
>
> e.g:
>
> destination d_nginx_modsec_log {
>     file("/var/logs/myapp//${j.key:-invalid_key}.log"
>  template(t_raw2json)  );
> };
>
> Question: is it possible to normalize the jSON keys to lowercase? or
> someone has other approaches?
> --
> Jorge Pereira
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170111/95a28d44/attachment.html>