Hello. Syslog implementation rsyslog has a module named mmjsonparse which is able to parse JSON data prefixed with special cookie. It can be set to arbitrary value, but de-facto standard is @cee: which stands for CEE initiative by MITRE and project Lumberjack hosted on Fedora.
While it is possible to set cookie-less parsing using this statement in rsyslog configuration:
action(type="mmjsonparse" cookie="")
this must be done globally as mmjsonparse cannot be used in if-statement, therefore use of cookie prefix is unavoidable. This patch adds an extra option for JSON layout called "prefix" and if present, all messages are prefixed with an arbitrary string. The prefix is ignored for YAML where it's not relevant.
Hello. Syslog implementation
rsyslog
has a module named mmjsonparse which is able to parse JSON data prefixed with special cookie. It can be set to arbitrary value, but de-facto standard is@cee:
which stands for CEE initiative by MITRE and project Lumberjack hosted on Fedora.While it is possible to set cookie-less parsing using this statement in rsyslog configuration:
this must be done globally as mmjsonparse cannot be used in if-statement, therefore use of cookie prefix is unavoidable. This patch adds an extra option for JSON layout called "prefix" and if present, all messages are prefixed with an arbitrary string. The prefix is ignored for YAML where it's not relevant.
https://www.rsyslog.com/doc/master/configuration/modules/mmjsonparse.html