From 2f7586bbe415318c35b9ec6d4680c81d443a6660 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Sat, 25 Aug 2012 12:35:09 +0200 Subject: cleanup: remove left-over commented-out code --- tools/syslogd.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/tools/syslogd.c b/tools/syslogd.c index 90f78d25..81150677 100644 --- a/tools/syslogd.c +++ b/tools/syslogd.c @@ -215,16 +215,6 @@ int repeatinterval[2] = { 30, 60 }; /* # of secs before flush */ static pid_t ppid; /* This is a quick and dirty hack used for spliting main/startup thread */ -#if 0 -#warning need this? -//======= -typedef struct legacyOptsLL_s { - uchar *line; - struct legacyOptsLL_s *next; -} legacyOptsLL_t; -legacyOptsLL_t *pLegacyOptsLL = NULL; -#endif - struct queuefilenames_s { struct queuefilenames_s *next; uchar *name; -- cgit From e1753e3dd1b03f2ca8863bbaee3ab799dca4932e Mon Sep 17 00:00:00 2001 From: Miloslav Trmač Date: Sat, 11 Aug 2012 09:48:10 +0200 Subject: Fix printing of some template options MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Miloslav Trmač --- template.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/template.c b/template.c index a80ac6fb..e80015da 100644 --- a/template.c +++ b/template.c @@ -1364,7 +1364,10 @@ void tplPrintList(rsconf_t *conf) dbgprintf("[format as CSV (RFC4180)]"); } if(pTpe->data.field.options.bJSON) { - dbgprintf("[format as JSON"); + dbgprintf("[format as JSON] "); + } + if(pTpe->data.field.options.bJSONf) { + dbgprintf("[format as JSON field] "); } if(pTpe->data.field.options.bDropLastLF) { dbgprintf("[drop last LF in msg] "); -- cgit From 7580b8c954ad2291198c52b7bc50ae7a41be65a5 Mon Sep 17 00:00:00 2001 From: Miloslav Trmač Date: Thu, 9 Aug 2012 17:07:17 +0200 Subject: Remove a no-effect ", NULL"; MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It does nothing, at is just confusing. Signed-off-by: Miloslav Trmač --- plugins/ommongodb/ommongodb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/ommongodb/ommongodb.c b/plugins/ommongodb/ommongodb.c index 39e2e4f9..aa20b33f 100644 --- a/plugins/ommongodb/ommongodb.c +++ b/plugins/ommongodb/ommongodb.c @@ -340,7 +340,7 @@ CODESTARTnewActInst if(!strcmp(actpblk.descr[i].name, "server")) { pData->server = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL); } else if(!strcmp(actpblk.descr[i].name, "serverport")) { - pData->port = (int) pvals[i].val.d.n, NULL; + pData->port = (int) pvals[i].val.d.n; } else if(!strcmp(actpblk.descr[i].name, "db")) { pData->db = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL); } else if(!strcmp(actpblk.descr[i].name, "collection")) { -- cgit From e48728e80e6ce7b94319363581040774067de0fe Mon Sep 17 00:00:00 2001 From: Miloslav Trmač Date: Fri, 24 Aug 2012 19:28:59 +0200 Subject: INCOMPATIBLE: use :, not =, as separator for jsonf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit JSON fields are "name":value, not "name"=value. Therefore change the jsonf flag to use a colon. Signed-off-by: Miloslav Trmač --- doc/property_replacer.html | 2 +- runtime/msg.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 4c92bf4c..86a07474 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -368,7 +368,7 @@ The json option cannot be used together with either jsonf or csv options. This signifies that the property should be expressed as a json field. That means not only the property is written, but rather a complete json field in the format
-"fieldname"="value" +"fieldname":"value" where "filedname" is the assigend field name (or the property name if none was assigned) and value is the end result of property replacer operation. Note that value supports all property replacer options, like substrings, case converson and the like. diff --git a/runtime/msg.c b/runtime/msg.c index da751dba..61c2f87b 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -2518,7 +2518,7 @@ jsonField(struct templateEntry *pTpe, uchar **ppRes, unsigned short *pbMustBeFre dst = es_newStr(buflen+es_strlen(pTpe->data.field.fieldName)+15); es_addChar(&dst, '"'); es_addStr(&dst, pTpe->data.field.fieldName); - es_addBufConstcstr(&dst, "\"=\""); + es_addBufConstcstr(&dst, "\":\""); CHKiRet(jsonAddVal(pSrc, buflen, &dst)); es_addChar(&dst, '"'); -- cgit From 9068d7fa1e1ce57ab55838866ac58b060721193e Mon Sep 17 00:00:00 2001 From: Miloslav Trmač Date: Fri, 24 Aug 2012 19:33:24 +0200 Subject: INCOMPATIBLE: Return {} for missing $!all-json MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit %$!all-json% will return a {}-wrapped object if there are are any events, or when there is an attached (empty) pMsg->event, but an empty string if nothing is attached. Let it return an empty object "{}" in that case for consistency. In particular, this allows $template MongoTemplate,"{%hostname:::jsonf:sys%, %$!all-json:2:$:%" to always result in a valid JSON. Signed-off-by: Miloslav Trmač --- runtime/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/runtime/msg.c b/runtime/msg.c index 61c2f87b..44d36fef 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -2734,7 +2734,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe, if(pMsg->event == NULL) { if(*pbMustBeFreed == 1) free(pRes); - pRes = (uchar*) ""; + pRes = (uchar*) "{}"; *pbMustBeFreed = 0; } else { ee_fmtEventToJSON(pMsg->event, &str); -- cgit From 9a9282b86c785d7c0b67a0b546748e3591a487a2 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Sun, 26 Aug 2012 12:27:37 +0200 Subject: doc: add incompatible patch info to ChangeLog --- ChangeLog | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/ChangeLog b/ChangeLog index dd165e1d..95cd80e5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,18 @@ Version 6.4.1 [V6-STABLE] 2012-08-?? This lead to queue file corruption. While the root cause is a config error, it is a bug that this important and hard to find config error was not detected by rsyslog. +- bugfix: "jsonf" property replacer option did generate invalid JSON + in JSON, we have "fieldname":"value", but the option emitted + "fieldname"="value". Interestingly, this was accepted by a couple + of sinks, most importantly elasticsearch. Now the correct format is + emitted, which causes a remote chance that some things that relied on + the wrong format will break. + Thanks to Miloslav Trmač for the patch +- change $!all-json did emit an empty (thus non-JSON) string if no libee + data was present. It now emits {} and thus valid JSON. There is a + small risk that this may break some things that relied on the previous + inconsistency. + Thanks to Miloslav Trmač for the patch --------------------------------------------------------------------------- Version 6.4.0 [V6-STABLE] 2012-08-20 - THIS IS THE FIRST VERSION OF THE 6.4.x STABLE BRANCH -- cgit