RFC5424 structured data parsing module (mmpstrucdata)

Module Name:    mmpstrucdata

Author: Rainer Gerhards <rgerhards@adiscon.com>

Available since: 7.5.4

Description:

The mmpstrucdata parses RFC5424 structured data into the message json variable tree.

Module Configuration Parameters:

Currently none.

Action Confguration Parameters:

• jsonRoot - default "!"
  Specifies into which json container the data shall be parsed to.

See Also

• Howto anonymize messages that go to specific files

Caveats/Known Bugs:

• this module is currently experimental; feedback is appreciated
• structured data with duplicate SD-IDs and SD-PARAMS is not properly processed

Samples:

In this snippet, we parse the message and emit all json variable to a file with the message anonymized. Note that once mmpstrucdata has run, access to the original message is no longer possible (execept if stored in user variables before anonymization).

module(load="mmpstrucdata") action(type="mmpstrucdata") template(name="jsondump" type="string" string="%msg%: %$!%\n") action(type="omfile" file="/path/to/log" template="jsondump")

[rsyslog.conf overview] [manual index] [rsyslog site]

This documentation is part of the rsyslog project.
Copyright © 2013 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.