Mailing List Archive

Help with custom template and field for mysql output
Can anyone share an example config file for parsing json messages and
outputting them to a custom table (fields),

Pertinent part of config that I've tried:

$ModLoad ommysql

module(load="mmjsonparse")

template(name="StdSQLformat" type="list" option.sql="on") {
??????? constant(value="insert into mylog (bxmsg, level)")
??????? constant(value=" values ('")
??????? property(name="%bxmsg%")
??????? constant(value="', ")
??????? property(name="%level%")
??????? constant(value="')")
??????? }

local0.* action(type="mmjsonparse",template="StdSQLformat")

local0.*?? :ommysql:127.0.0.1,mydb,myuser,mypass



_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Help with custom template and field for mysql output [ In reply to ]
a sample of the log you are trying to parse would help a lot.

David Lang

On Thu, 29 Jul 2021, Bill Schoolfield via rsyslog wrote:

> Date: Thu, 29 Jul 2021 17:11:14 -0500
> From: Bill Schoolfield via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Bill Schoolfield <bill@billmax.com>
> Subject: [rsyslog] Help with custom template and field for mysql output
>
> Can anyone share an example config file for parsing json messages and
> outputting them to a custom table (fields),
>
> Pertinent part of config that I've tried:
>
> $ModLoad ommysql
>
> module(load="mmjsonparse")
>
> template(name="StdSQLformat" type="list" option.sql="on") {
> ??????? constant(value="insert into mylog (bxmsg, level)")
> ??????? constant(value=" values ('")
> ??????? property(name="%bxmsg%")
> ??????? constant(value="', ")
> ??????? property(name="%level%")
> ??????? constant(value="')")
> ??????? }
>
> local0.* action(type="mmjsonparse",template="StdSQLformat")
>
> local0.*?? :ommysql:127.0.0.1,mydb,myuser,mypass
>
>
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Help with custom template and field for mysql output [ In reply to ]
https://www.rsyslog.com/doc/v8-stable/rainerscript/functions/rs-parse_json.html <https://www.rsyslog.com/doc/v8-stable/rainerscript/functions/rs-parse_json.html>

The documentation is the best resource, but this list runs a close second.
The new syntax format makes configurations much clearer, and exposes some functionality that the legacy syntax cannot.

set $.isJson = parse_json($msg, "\$!parsed");

if ($.isJson == 0) then {
set $!jsonmsg = $msg;
set $!strmsg = "";
} else {
set $!jsonmsg = "null";
set $!strmsg = $msg;
}

If parsing was successful, the content is contained in $!parsed. It’s not used or referenced in the above example, but it could be.

Note that object identification (isJson or not) fails in some cases. Informal research suggest this happens in some circumstances where strings begin with a numeric character (especially a zero “0”) and are misidentified as objects.

Regards,


> On Jul 29, 2021, at 17:20, David Lang via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> a sample of the log you are trying to parse would help a lot.
>
> David Lang
>
> On Thu, 29 Jul 2021, Bill Schoolfield via rsyslog wrote:
>
>> Date: Thu, 29 Jul 2021 17:11:14 -0500
>> From: Bill Schoolfield via rsyslog <rsyslog@lists.adiscon.com>
>> To: rsyslog@lists.adiscon.com
>> Cc: Bill Schoolfield <bill@billmax.com>
>> Subject: [rsyslog] Help with custom template and field for mysql output
>> Can anyone share an example config file for parsing json messages and outputting them to a custom table (fields),
>>
>> Pertinent part of config that I've tried:
>>
>> $ModLoad ommysql
>>
>> module(load="mmjsonparse")
>>
>> template(name="StdSQLformat" type="list" option.sql="on") {
>> constant(value="insert into mylog (bxmsg, level)")
>> constant(value=" values ('")
>> property(name="%bxmsg%")
>> constant(value="', ")
>> property(name="%level%")
>> constant(value="')")
>> }
>>
>> local0.* action(type="mmjsonparse",template="StdSQLformat")
>>
>> local0.* :ommysql:127.0.0.1,mydb,myuser,mypass
>>
>>
>>
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.