From f7debed88d432708109040c7eda8985d4d5f1dc8 Mon Sep 17 00:00:00 2001 From: Radu Gheorghe Date: Tue, 15 Jan 2013 19:30:03 +0200 Subject: - added $!all-json to property replacer - specified that $! can be used with CEE-enhanced syslog (once parsed via mmjsonparse) --- doc/property_replacer.html | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/doc/property_replacer.html b/doc/property_replacer.html index dc09d33c..c7624b2d 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -228,7 +228,15 @@ for filtering in a generic way) This is the "bridge" to syslog message normalization (via mmnormalize): name is a name defined inside the normalization rule. It has the value selected by the rule -or none if no rule with this field did match. +or none if no rule with this field did match. You can also use these +properties to specify JSON fields from the CEE-enhanced syslog +message, once you parse it with mmjsonparse + + + +$!all-json +This is the JSON part of the CEE-enhanced syslog message, which +can be parsed with mmjsonparse -- cgit v1.2.3