Mailing List Archive: formatting the msg part to json

Hi

I'm new to rsyslog and trying to find to format the msg part of the syslog
message to json. I only found samples that format all the syslog message to
json, but the value of the msg is not formatted to json.
The msg part consist of key value pairs key1=value1, key2=value2... . The
separators may be commas, tabs or other in different messages.
Is there a way to get a result of { "key1" = "value1", "key2" = "value2" …
} without knowing the keys in advance?
If not can someone send an example of getting the formatted json with known
keys ?
Best Regards
Asaf Segal
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

please post a sample log and what you want the result to look like, that will
make it much easier to figure out what you are meaning.

David Lang

On Fri, 2 Jul 2021, Asaf Segal via rsyslog wrote:

> Date: Fri, 2 Jul 2021 18:18:25 +0000
> From: Asaf Segal via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Asaf Segal <asafsegal666@gmail.com>
> Subject: [rsyslog] formatting the msg part to json
>
> Hi
>
> I'm new to rsyslog and trying to find to format the msg part of the syslog
> message to json. I only found samples that format all the syslog message to
> json, but the value of the msg is not formatted to json.
> The msg part consist of key value pairs key1=value1, key2=value2... . The
> separators may be commas, tabs or other in different messages.
> Is there a way to get a result of { "key1" = "value1", "key2" = "value2" …
> } without knowing the keys in advance?
> If not can someone send an example of getting the formatted json with known
> keys ?
> Best Regards
> Asaf Segal
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.