1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
***********************************************************
JSON/CEE Structured Content Extraction Module (mmjsonparse)
***********************************************************
=========================== ===========================================================================
**Module Name:** **mmjsonparse**
**Author:** `Rainer Gerhards <https://rainer.gerhards.net/>`_ <rgerhards@adiscon.com>
**Available since:** 6.6.0
=========================== ===========================================================================
Purpose
=======
This module provides support for parsing structured log messages that
follow the CEE/lumberjack spec. The so-called "CEE cookie" is checked
and, if present, the JSON-encoded structured message content is parsed.
The properties are then available as original message properties.
As a convenience, mmjsonparse will produce a valid CEE/lumberjack log
message if passed a message without the CEE cookie. A JSON structure
will be created and the "msg" field will be the only field and it will
contain the message. Note that in this case, mmjsonparse will
nonetheless return that the JSON parsing has failed.
The "CEE cookie" is the character squence "@cee:" which must prepend the
actual JSON. Note that the JSON must be valid and MUST NOT be followed
by any non-JSON message. If either of these conditions is not true,
mmjsonparse will **not** parse the associated JSON. This is based on the
cookie definition used in CEE/project lumberjack and is meant to aid
against an erroneous detection of a message as being CEE where it is
not.
This also means that mmjsonparse currently is NOT a generic JSON parser
that picks up JSON from wherever it may occur in the message. This is
intentional, but future versions may support config parameters to relax
the format requirements.
Notable Features
================
- :ref:`mmjsonparse-parsing-result`
Configuration Parameters
========================
.. note::
Parameter names are case-insensitive.
Action Parameters
-----------------
cookie
^^^^^^
.. csv-table::
:header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
:widths: auto
:class: parameter-table
"string", "@cee:", "no", "none"
Permits to set the cookie that must be present in front of the
JSON part of the message.
Most importantly, this can be set to the empty string ("") in order
to not require any cookie. In this case, leading spaces are permitted
in front of the JSON. No non-whitespace characters are permitted
after the JSON. If such is required, mmnormalize must be used.
useRawMsg
^^^^^^^^^
.. csv-table::
:header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
:widths: auto
:class: parameter-table
"binary", "off", "no", "none"
Specifies if the raw message should be used for normalization (on)
or just the MSG part of the message (off).
container
^^^^^^^^^
.. csv-table::
:header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
:widths: auto
:class: parameter-table
"string", "$!", "no", "none"
Specifies the JSON container (path) under which parsed elements should be
placed. By default, all parsed properties are merged into root of
message properties. You can place them under a subtree, instead. You
can place them in local variables, also, by setting path="$.".
.. _mmjsonparse-parsing-result:
Check parsing result
====================
You can check whether rsyslogd was able to successfully parse the
message by reading the $parsesuccess variable :
.. code-block:: none
action(type="mmjsonparse")
if $parsesuccess == "OK" then {
action(type="omfile" File="/tmp/output")
}
else if $parsesuccess == "FAIL" then {
action(type="omfile" File="/tmp/parsing_failure")
}
Examples
========
Apply default normalization
---------------------------
This activates the module and applies normalization to all messages.
.. code-block:: none
module(load="mmjsonparse")
action(type="mmjsonparse")
Permit parsing messages without cookie
--------------------------------------
To permit parsing messages without cookie, use this action statement
.. code-block:: none
action(type="mmjsonparse" cookie="")
|
