Problemdescription
I am using rsyslog mainly for logging the logs of docker, because docker can only decide the servity based on where it came from (stderr or stdout), I try to get the servity from the log message. Some program logs are put out in json. When i use mmnormalize I can only take the property names of the original jsonobject.
For that it would be helpful to be able to cange the propertyname after deserialization (of course only of specified properties).
Workaround
Another possibility would be to check if the jsonproperty exists after deserialization and then change the property. But I think it fits better in the normalization part.
Hello,
Summary I would like to be able to change the result propertynames of the json type after deserialization.
example configuration
rule=:%[{"type": "json", "name": "json", "property": {"log.level": "servity", "servity": "servity"}]%Problemdescription I am using rsyslog mainly for logging the logs of docker, because docker can only decide the servity based on where it came from (stderr or stdout), I try to get the servity from the log message. Some program logs are put out in json. When i use mmnormalize I can only take the property names of the original jsonobject. For that it would be helpful to be able to cange the propertyname after deserialization (of course only of specified properties).
Workaround Another possibility would be to check if the jsonproperty exists after deserialization and then change the property. But I think it fits better in the normalization part.
Please share your opinion and Thanks for reading.