From 629efc063125d9f63d4fe30e4f9e86dc44429ad1 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 16 Sep 2013 18:54:18 +0200 Subject: doc: describe "CEE cookie" required by mmjsonparse ... as well as other format requirements. --- doc/mmjsonparse.html | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/doc/mmjsonparse.html b/doc/mmjsonparse.html index c2c862d7..20a44f7a 100644 --- a/doc/mmjsonparse.html +++ b/doc/mmjsonparse.html @@ -15,6 +15,16 @@ that follow the CEE/lumberjack spec. The so-called "CEE cookie" is checked and, if present, the JSON-encoded structured message content is parsed. The properties are than available as original message properties.

+

The "CEE cookie" is the character squence "@cee:" which must prepend the +actual JSON. Note that the JSON must be valid and MUST NOT be followed by +any non-JSON message. If either of these conditions is not true, mmjsonparse +will not parse the associated JSON. This is based on the cookie +definition used in CEE/project lumberjack and is meant to aid against +an errornous detection of a message as being CEE where it is not. +

This also means that mmjsonparse currently is NOT a generic JSON +parser that picks up JSON from whereever it may occur in the message. This +is intentional, but future versions may support config parameters to +relax the format requirements.

Action specific Configuration Directives:

currently none