From 7f0cd8c8b93ca395949e5d28c3a8f422e6695c8d Mon Sep 17 00:00:00 2001
From: Rainer Gerhards
Date: Thu, 19 Apr 2012 15:20:16 +0200
Subject: added the "jsonf" property replacer option (and fieldname) & bugfix
bugfix: property replacer option "json" could lead to content loss
message was truncated if escaping was necessary
---
doc/property_replacer.html | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
(limited to 'doc/property_replacer.html')
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index 1178b4ca..5ee1d096 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -13,7 +13,7 @@ the value, e.g. by converting all characters to lower case.
Syslog message properties are used inside templates. They are
accessed by putting them between percent signs. Properties can be
modified by the property replacer. The full syntax is as follows:
-%propname:fromChar:toChar:options%
+%propname:fromChar:toChar:options:fieldname%
Available Properties
propname
is the
name of the property to access. It is case-insensitive (prior to 3.17.0, they were case-senstive).
@@ -349,7 +349,24 @@ case-insensitive. Currently, the following options are defined:
json |
encode the value so that it can be used inside a JSON field. This means
that several characters (according to the JSON spec) are being escaped, for
-example US-ASCII LF is replaced by "\n". |
+example US-ASCII LF is replaced by "\n".
+The json option cannot be used together with either jsonf or csv options.
+
+
+
+jsonf |
+(available in 6.3.9+)
+This signifies that the property should be expressed as a json field.
+That means not only the property is written, but rather a complete json field in
+the format
+"fieldname"="value"
+where "filedname" is the assigend field name (or the property name if none was assigned)
+and value is the end result of property replacer operation. Note that value supports
+all property replacer options, like substrings, case converson and the like.
+Values are properly json-escaped. However, field names are (currently) not. It is
+expected that proper field names are configured.
+The jsonf option cannot be used together with either json or csv options.
+ |
csv |
@@ -360,6 +377,7 @@ text, you need to define a proper template. An example is this one:
$template csvline,"%syslogtag:::csv%,%msg:::csv%"
Most importantly, you need to provide the commas between the fields
inside the template.
+The csv option cannot be used together with either json or jsonf options.
This feature was introduced in rsyslog 4.1.6.
@@ -465,13 +483,19 @@ Useful for secure pathname generation (with dynafiles).
them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together,
the last one will override the previous one. For example, using "escape-cc,drop-cc" will
use drop-cc and "drop-cc,escape-cc" will use escape-cc mode.
+Fieldname
+(available in 6.3.9+)
+
This field permits to specify a field name for structured-data emitting property replacer
+options. It was initially introduced to support the "jsonf" option, for which it provides
+the capability to set an alternative field name. If it is not specified, it defaults to
+the property name.
Further Links
[manual index]
[rsyslog.conf]
--
cgit