diff options
authorMiloslav Trmač <>2012-08-24 19:28:59 +0200
committerRainer Gerhards <>2012-08-26 11:45:22 +0200
commit3fd617f1acb7f1a057edb415cec1b144d210da81 (patch)
parent14875be702b0c90c098888cba689190cec031646 (diff)
INCOMPATIBLE: use :, not =, as separator for jsonf
JSON fields are "name":value, not "name"=value. Therefore change the jsonf flag to use a colon. Signed-off-by: Miloslav Trmač <>
2 files changed, 2 insertions, 2 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index 4c92bf4..86a0747 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -368,7 +368,7 @@ The json option cannot be used together with either jsonf or csv options.
This signifies that the property should be expressed as a json <b>f</b>ield.
That means not only the property is written, but rather a complete json field in
the format<br>
where "filedname" is the assigend field name (or the property name if none was assigned)
and value is the end result of property replacer operation. Note that value supports
all property replacer options, like substrings, case converson and the like.
diff --git a/runtime/msg.c b/runtime/msg.c
index da751db..61c2f87 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -2518,7 +2518,7 @@ jsonField(struct templateEntry *pTpe, uchar **ppRes, unsigned short *pbMustBeFre
dst = es_newStr(buflen+es_strlen(pTpe->data.field.fieldName)+15);
es_addChar(&dst, '"');
es_addStr(&dst, pTpe->data.field.fieldName);
- es_addBufConstcstr(&dst, "\"=\"");
+ es_addBufConstcstr(&dst, "\":\"");
CHKiRet(jsonAddVal(pSrc, buflen, &dst));
es_addChar(&dst, '"');