[syslog-ng] Check if field in message and use default if not.

[Péter, Kókai]

Hello,

This is should work on 3.16.1, it is an *old* feature.

On Tue, Mar 5, 2019 at 7:14 AM Ronald Fenner <rfenner at gamecircus.com> wrote:

> Thanks I see how that can work now.
>
> Does it require 3.20 or can I use this in 3.16?
>
> Ronald Fenner
> Network Architect
> Game Circus LLC.
>
> rfenner at gamecircus.com
>
> On Mar 5, 2019, at 12:08 AM, Péter, Kókai <peter.kokai at oneidentity.com>
> wrote:
>
> Hello,
>
> You could use rewrite rule for this, but in fact macro expansion is
> capable to solve your problem: `${.cake:-no-cake}` where if `.cake` exists
> uses its value, otherwise the string after `:-`
>
> @version: 3.20
>
> log {
>         source { stdin(flags(no-parse)); };
>         parser { kv-parser(prefix(".")); };
>         rewrite { set("[${.cake:-no-cake}]" value("MESSAGE")); };
>         #destination { file("/dev/stdout"
> template("${.cake:-undefined}\n")); };
>         destination { file("/dev/stdout"); };
> };
>
> As the result you could either use rewrite/set to add the value to the msg
> itself (other destination/parser/filter could use it), or you could just
> use it directly in the destination macro expansion.
> It really depends on your setup which place you should prefer.
>
> --
> Kokan
>
>
> On Tue, Mar 5, 2019 at 12:56 AM Ronald Fenner <rfenner at gamecircus.com>
> wrote:
>
>>
>> I generate a Kafka topic to send the message to by doing:
>> topic("${topic}.${environment}")
>> What I'd like to do if the field wasn't in the json message to provide a
>> default value.
>>
>> Im looking for like a tertiary operator to use In the topic or perhaps a
>> rewrite rule.
>>
>> I see the conditional expressions but from the docs it doesn't look like
>> I can use it in the topic or a rewrite rule
>> NOTE: My messages are json stings that get parsed and then imploded back
>> to json as it's sent.
>>
>> Thanks
>>
>> Ronald Fenner
>> Network Architect
>> Game Circus LLC.
>>
>> rfenner at gamecircus.com
>>
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation:
>> http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190305/c01a9a71/attachment-0001.html>