From 7f0cd8c8b93ca395949e5d28c3a8f422e6695c8d Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 19 Apr 2012 15:20:16 +0200 Subject: added the "jsonf" property replacer option (and fieldname) & bugfix bugfix: property replacer option "json" could lead to content loss message was truncated if escaping was necessary --- doc/property_replacer.html | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) (limited to 'doc/property_replacer.html') diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 1178b4ca..5ee1d096 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -13,7 +13,7 @@ the value, e.g. by converting all characters to lower case.

Syslog message properties are used inside templates. They are accessed by putting them between percent signs. Properties can be modified by the property replacer. The full syntax is as follows:

-
%propname:fromChar:toChar:options%
+
%propname:fromChar:toChar:options:fieldname%

Available Properties

propname is the name of the property to access. It is case-insensitive (prior to 3.17.0, they were case-senstive). @@ -349,7 +349,24 @@ case-insensitive. Currently, the following options are defined: json encode the value so that it can be used inside a JSON field. This means that several characters (according to the JSON spec) are being escaped, for -example US-ASCII LF is replaced by "\n". +example US-ASCII LF is replaced by "\n". +The json option cannot be used together with either jsonf or csv options. + + + +jsonf +(available in 6.3.9+) +This signifies that the property should be expressed as a json field. +That means not only the property is written, but rather a complete json field in +the format
+"fieldname"="value" +where "filedname" is the assigend field name (or the property name if none was assigned) +and value is the end result of property replacer operation. Note that value supports +all property replacer options, like substrings, case converson and the like. +Values are properly json-escaped. However, field names are (currently) not. It is +expected that proper field names are configured. +The jsonf option cannot be used together with either json or csv options. + csv @@ -360,6 +377,7 @@ text, you need to define a proper template. An example is this one:
$template csvline,"%syslogtag:::csv%,%msg:::csv%"
Most importantly, you need to provide the commas between the fields inside the template. +The csv option cannot be used together with either json or jsonf options.
This feature was introduced in rsyslog 4.1.6. @@ -465,13 +483,19 @@ Useful for secure pathname generation (with dynafiles). them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together, the last one will override the previous one. For example, using "escape-cc,drop-cc" will use drop-cc and "drop-cc,escape-cc" will use escape-cc mode. +

Fieldname

+

(available in 6.3.9+) +

This field permits to specify a field name for structured-data emitting property replacer +options. It was initially introduced to support the "jsonf" option, for which it provides +the capability to set an alternative field name. If it is not specified, it defaults to +the property name.

Further Links

[manual index] [rsyslog.conf] -- cgit