[syslog-ng] is it possible to normalize the jSON keys to lowercase?

[Jorge Pereira]

Hi,

Thanks for all suggestions. But, I solved the problem doing such hacking
creating a new parser() as the below sample.

...............
rewrite p_my_key {
    set("${Key}", value("my_key"), condition("${Key}" != ""));
    set("${key}", value("my_key"), condition("${key}" != ""));
};
............
destination d_my_log {
    file("/var/logs/myapp/${my_key:-invalid_key}.log"  template(t_raw2json)
 );
};

--
Jorge Pereira

On Wed, Jan 11, 2017 at 7:06 AM, Fekete, Róbert <robert.fekete at balabit.com>
wrote:

> Oh, right. Well, you could make an extra round of formatting+parsing, like
> incoming-message>format-json>lowercase-the-formatted-json>json-parser>format-json,
> but that would not be too efficient performance-wise.
> Or maybe you could use the lowercase function on the incoming message,
> depending on what it is like.
>
> On Wed, Jan 11, 2017 at 9:46 AM, Fabien Wernli <wernli at in2p3.fr> wrote:
>
>> On Wed, Jan 11, 2017 at 09:39:48AM +0100, Fekete, Róbert wrote:
>> > Actually, in the docs we mention a 'lowercase' template function, I
>> think
>> > algernon wrote it a few years ago, you can give it a try.
>>
>> But that will not let you munge the keys, unfortunately
>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support
>> /documentation/?product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=
> syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170111/d671017e/attachment.html>