1 files changed, 64 insertions, 2 deletions
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index f4c4238e..4c92bf4c 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -13,7 +13,7 @@ the value, e.g. by converting all characters to lower case.</p>
 <p>Syslog message properties are used inside templates. They are
 accessed by putting them between percent signs. Properties can be
 modified by the property replacer. The full syntax is as follows:</p>
-<blockquote><b><code>%propname:fromChar:toChar:options%</code></b></blockquote>
+<blockquote><b><code>%propname:fromChar:toChar:options:fieldname%</code></b></blockquote>
 <h2>Available Properties</h2>
 <p><b><code>propname</code></b> is the
 name of the property to access. It is case-insensitive (prior to 3.17.0, they were case-senstive).
@@ -138,6 +138,25 @@ draft-ietf-syslog-protocol</td>
 <td>The contents of the MSGID field from
 IETF draft draft-ietf-syslog-protocol</td>
 </tr>
+<tr>
+<td><b>parsesuccess</b></td>
+<td>This returns the status of the <b>last</b> called higher level parser,
+like mmjsonparse. A higher level parser parses the actual message for additional
+structured data and maintains an extra property table while doing so (this is
+often referred to as "cee data" because the idea was originally rooted in the
+cee effort, only (but has been extended since then). Note that higher level
+parsers must explicitely support (and set) this property. So, depending on the
+parser, it may not be set correctly.
+<br>If the parser properly supports it, the value "OK" means that parsing was
+successfull, while "FAIL" means the parser could not successfully obtain any data.
+Failure state is not necessarily an error. For example, it may simple indicate
+that the cee-enhanced syslog parser (mmjsonparse) did not detect cee-enhanced format,
+what can be totally valid. Using this property, further processing of the message
+can be directed based on this parsing outcome. If no parser has been called at the
+time this property is accessed, it will contain "FAIL".
+<br><b>This property is available since version 6.3.8.</b>
+</td>
+</tr>
 <td><b>inputname</b></td>
 <td>The name of the input module that generated the
 message (e.g. "imuxsock", "imudp"). Note that not all modules
@@ -285,6 +304,15 @@ fields in the property is requested. The field number must be placed in
 the "ToChar" parameter. An example where the 3rd field (delimited by
 TAB) from the msg property is extracted is as follows: "%msg:F:3%". The
 same example with semicolon as delimiter is "%msg:F,59:3%".</p>
+<p>The use of fields does not permit to select substrings, what is rather
+unfortunate. To solve this issue, starting with 6.3.9, fromPos and toPos
+can be specified for strings as well. However, the syntax is quite ugly, but
+it was the only way to integrate this functonality into the already-existing
+system. To do so, use ",fromPos" and ",toPos" during field extraction.
+Let's assume you want to extract the substring from position 5 to 9 in the previous
+example. Then, the syntax is as follows: "%msg:F,59,5:3,9%". As you can see,
+"F,59" means field-mode, with semicolon delimiter and ",5" means starting 
+at position 5. Then "3,9" means field 3 and string extraction to position 9.
 <p>Please note that the special characters "F" and "R" are
 case-sensitive. Only upper case works, lower case will return an error.
 There are no white spaces permitted inside the sequence (that will lead
@@ -327,6 +355,29 @@ case-insensitive. Currently, the following options are defined:
 <td>convert property text to uppercase only</td>
 </tr>
 <tr>
+<td><b>json</b></td>
+<td>encode the value so that it can be used inside a JSON field. This means
+that several characters (according to the JSON spec) are being escaped, for 
+example US-ASCII LF is replaced by "\n".
+The json option cannot be used together with either jsonf or csv options.
+</td>
+</tr>
+<tr>
+<td><b>jsonf</b></td>
+<td><i>(available in 6.3.9+)</i>
+This signifies that the property should be expressed as a json <b>f</b>ield.
+That means not only the property is written, but rather a complete json field in
+the format<br>
+"fieldname"="value"</b>
+where "filedname" is the assigend field name (or the property name if none was assigned)
+and value is the end result of property replacer operation. Note that value supports
+all property replacer options, like substrings, case converson and the like.
+Values are properly json-escaped. However, field names are (currently) not. It is
+expected that proper field names are configured.
+The jsonf option cannot be used together with either json or csv options.
+</td>
+</tr>
+<tr>
 <td valign="top"><b>csv</b></td>
 <td>formats the resulting field (after all modifications) in CSV format
 as specified in <a href="http://www.ietf.org/rfc/rfc4180.txt">RFC 4180</a>.
@@ -335,6 +386,7 @@ text, you need to define a proper template. An example is this one:
 <br>$template csvline,"%syslogtag:::csv%,%msg:::csv%"
 <br>Most importantly, you need to provide the commas between the fields
 inside the template.
+The csv option cannot be used together with either json or jsonf options.
 <br><i>This feature was introduced in rsyslog 4.1.6.</i>
 </td>
 </tr>
@@ -369,6 +421,10 @@ option when forwarding to remote hosts - they may treat the date as invalid
 <td>format as RFC 3339 date</td>
 </tr>
 <tr>
+<td><b>date-unixtimestamp</b></td>
+<td>format as unix timestamp (seconds since epoch)</td>
+</tr>
+<tr>
 <td><b>date-subseconds</b></td>
 <td>just the subseconds of a timestamp (always 0 for a low precision timestamp)</td>
 </tr>
@@ -436,13 +492,19 @@ Useful for secure pathname generation (with dynafiles).
 them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together,
 the last one will override the previous one. For example, using "escape-cc,drop-cc" will
 use drop-cc and "drop-cc,escape-cc" will use escape-cc mode.
+<h2>Fieldname</h2>
+<p><i>(available in 6.3.9+)</i>
+<p>This field permits to specify a field name for structured-data emitting property replacer
+options. It was initially introduced to support the "jsonf" option, for which it provides
+the capability to set an alternative field name. If it is not specified, it defaults to 
+the property name.
 <h2>Further Links</h2>
 <ul>
 <li>Article on "<a href="rsyslog_recording_pri.html">Recording
 the Priority of Syslog Messages</a>" (describes use of templates
 to record severity and facility of a message)</li>
 <li><a href="rsyslog_conf.html">Configuration file
-syntax</a>, this is where you actually use the property replacer.</li>
+format</a>, this is where you actually use the property replacer.</li>
 </ul>
 <p>[<a href="manual.html">manual index</a>]
 [<a href="rsyslog_conf.html">rsyslog.conf</a>]