diff options
authorMiloslav Trmač <>2012-08-24 19:28:59 +0200
committerRainer Gerhards <>2012-08-26 12:21:28 +0200
commite48728e80e6ce7b94319363581040774067de0fe (patch)
parent7580b8c954ad2291198c52b7bc50ae7a41be65a5 (diff)
INCOMPATIBLE: use :, not =, as separator for jsonf
JSON fields are "name":value, not "name"=value. Therefore change the jsonf flag to use a colon. Signed-off-by: Miloslav Trmač <>
2 files changed, 2 insertions, 2 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index 4c92bf4..86a0747 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -368,7 +368,7 @@ The json option cannot be used together with either jsonf or csv options.
This signifies that the property should be expressed as a json <b>f</b>ield.
That means not only the property is written, but rather a complete json field in
the format<br>
where "filedname" is the assigend field name (or the property name if none was assigned)
and value is the end result of property replacer operation. Note that value supports
all property replacer options, like substrings, case converson and the like.
diff --git a/runtime/msg.c b/runtime/msg.c
index da751db..61c2f87 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -2518,7 +2518,7 @@ jsonField(struct templateEntry *pTpe, uchar **ppRes, unsigned short *pbMustBeFre
dst = es_newStr(buflen+es_strlen(pTpe->data.field.fieldName)+15);
es_addChar(&dst, '"');
es_addStr(&dst, pTpe->data.field.fieldName);
- es_addBufConstcstr(&dst, "\"=\"");
+ es_addBufConstcstr(&dst, "\":\"");
CHKiRet(jsonAddVal(pSrc, buflen, &dst));
es_addChar(&dst, '"');