[syslog-ng] is it possible to normalize the jSON keys to lowercase?

[Fekete, Róbert]

Actually, in the docs we mention a 'lowercase' template function, I think
algernon wrote it a few years ago, you can give it a try.
https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html


On Wed, Jan 11, 2017 at 8:43 AM, Scheidler, Balázs <
balazs.scheidler at balabit.com> wrote:

> Not right now, but value-pairs does support key transformations
> (add-prefix and friends), and the same way lowercasing could happen there.
>
> However, someone needs to come up with an implementation, as right now, I
> don't see when I could get to it.
>
> The required code is in lib/value-pairs/transforms.c, and then its parsing
> needs to be added to both the cmdline parser (lib/value-pairs/cmdline.c)
> and the grammar (vp_rekey_options in cfg-grammar.y)
>
> HTH,
> Bazsi
>
> --
> Bazsi
>
> On Wed, Jan 11, 2017 at 12:03 AM, Jorge Pereira <jpereiran at gmail.com>
> wrote:
>
>> Hi,
>>
>>    I am using the 'format-json' as my below snip.
>>
>> template t_raw2json {
>>     template("$(format-json --scope selected_macros \
>>                             --exclude TAGS          \
>>                             --exclude DATE          \
>>                             --exclude PRIORITY      \
>>                             --exclude FACILITY      \
>>                             --exclude PROGRAM
>>     )\n");
>> };
>>
>>
>> but, the problem is because sometimes I receive a jSON packet as { "Key":
>> "value" } or {"key": "value}".... this has been a problem to my filter.
>>
>> e.g:
>>
>> destination d_nginx_modsec_log {
>>     file("/var/logs/myapp//${j.key:-invalid_key}.log"
>>  template(t_raw2json)  );
>> };
>>
>> Question: is it possible to normalize the jSON keys to lowercase? or
>> someone has other approaches?
>> --
>> Jorge Pereira
>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170111/a05acfec/attachment-0001.html>