[syslog-ng] exclude empty pairs from json-parser()

[Nik Ambrosch]

My application was sending empty pairs which would be passed on through
syslog-ng.

The first idea was having syslog-ng turn { "key1":"val1", "key2":"" } into
{ "key1":"val1" }

Instead i've modified my service to validate every field before encoding
the json string so it never sends empty fields to begin with.  This solves
the issue with my application but there may still be a use case for other
applications where app-side validation is not an option.


On Tue, May 22, 2018 at 3:38 AM, Scheidler, Balázs <
balazs.scheidler at balabit.com> wrote:

> Hi,
>
> Hmm, it was a feature to handle zero length values properly, and at the
> same time I've added the unset() rewrite operation, which causes name-value
> pairs to be omitted.
>
> It might make sense to add a --skip-empty-values or similar option to
> $(format-json), would that solve your problem? Can you elaborate your
> use-case?
>
> Thanks
>
> --
> Bazsi
>
> On Tue, May 22, 2018 at 7:50 AM, Nik Ambrosch <nik at ambrosch.com> wrote:
>
>> Hi - I'm trying to figure out how to instruct json-parser() to exclude
>> empty (or nonexistent) json pairs from being passed to it's template.  This
>> is possible with the csv parser using null("") but not json.
>>
>> It seems that if i specify all my json-parser() pairs using --pair
>> example=\"${MYMACRO}\" the desired behavior is achieved, however using
>> --scope nv-pairs instead will log the empty values.
>>
>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180523/574d48ad/attachment.html>