Mailing List Archive

Usage of all-json property with jsonf format in template
Hi there,

I'd like to create a template using the handy "jsonf" format combining custom properties and the "all-json" property like so:

template(name="json" type="list" option.jsonf="on"){
property(outname="@timestamp" name="timegenerated" dateFormat="rfc3339" format="jsonf")
constant(outname="tags" value="[\"test\"]" format="jsonf")
property(name="$!all-json" position.from="2")
}

Now the issue is that there does not seem to be any option which allows stripping the enclosing brackets from the "all-json" property. Either way,
"position.from" or "position.to" combined with "position.relativeToEnd" allows stripping either "{" or "}" but never both as the length of the value varies.
Using format="jsonf" will handle the value as string and not as a JSON object which is not what I want.

Is there any option available which provides the required behaviour with jsonf enabled?


Thank you in advance and best regards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Usage of all-json property with jsonf format in template [ In reply to ]
create the variable in the $! namespace and it will be part of $!all-json

there isn't a way to say "include this json content, but not the top level of
it"

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Usage of all-json property with jsonf format in template [ In reply to ]
I think the root question is why all-json is needed here in the first
place...

Iirc $! As property should do.

Rainer

Sent from phone, thus brief.

David Lang via rsyslog <rsyslog@lists.adiscon.com> schrieb am Do., 1. Aug.
2019, 17:28:

> create the variable in the $! namespace and it will be part of $!all-json
>
> there isn't a way to say "include this json content, but not the top level
> of
> it"
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Usage of all-json property with jsonf format in template [ In reply to ]
The resulting output is the same no matter if using "$!" or "$!all-json".

When using the template:

template(name="all_json" type="list" option.jsonf="on"){
property(outname="@timestamp" name="timegenerated" dateFormat="rfc3339" format="jsonf")
constant(outname="tags" value="[\"test\"]" format="jsonf")
property(name="$!")
}

The following output is returned and I didn't find a way to strip the brackets:

{
"@timestamp":"2019-08-02T07:05:08.994197+00:00",
"tags": "[\"test\"]",
{
"foo": "bar"
}
}

My goal was to combine JSON message properties with the "jsonf" format in order to avoid the need to specify constants for the JSON format like

template(name="all_json" type="list"){
constant(value="{")
constant(value="\"@timestamp\":\"") property(name="timegenerated" dateFormat="rfc3339")
constant(value="\",\"tags\":[\"test\"],")
property(name="$!all-json" position.from="2")
}

If there is no way to achieve it, I'll stick to the latter solution.


-----Original Message-----
From: rsyslog [mailto:rsyslog-bounces@lists.adiscon.com] On Behalf Of Rainer Gerhards via rsyslog
Sent: 01 August 2019 18:10
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Rainer Gerhards <rgerhards@hq.adiscon.com>
Subject: Re: [rsyslog] Usage of all-json property with jsonf format in template

I think the root question is why all-json is needed here in the first place...

Iirc $! As property should do.

Rainer

Sent from phone, thus brief.

David Lang via rsyslog <rsyslog@lists.adiscon.com> schrieb am Do., 1. Aug.
2019, 17:28:

> create the variable in the $! namespace and it will be part of
> $!all-json
>
> there isn't a way to say "include this json content, but not the top
> level of it"
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Usage of all-json property with jsonf format in template [ In reply to ]
there isn't a way to strip off the outer layer of {} that I know of.

you either make your new items be part of $! or $!all-json, or you make the
$!/$!all-json be a sub element of the resulting json.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.