<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>question Re: Nifi to ingest syslog and convert raw message to JSON and parse message to JSON in Support Questions</title>
    <link>https://community.cloudera.com/t5/Support-Questions/Nifi-to-ingest-syslog-and-convert-raw-message-to-JSON-and/m-p/338300#M232795</link>
    <description>&lt;P&gt;&lt;a href="https://community.cloudera.com/t5/user/viewprofilepage/user-id/11191"&gt;@araujo&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks&amp;nbsp;&lt;SPAN&gt;André&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;What if I wanted to turn the key value pairs separated by '=' in json content as in the original question? for instance the following syslog:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Griggsy_0-1646904682271.png" style="width: 400px;"&gt;&lt;img src="https://community.cloudera.com/t5/image/serverpage/image-id/33918i9B65156097D1A82D/image-size/medium?v=v2&amp;amp;px=400" role="button" title="Griggsy_0-1646904682271.png" alt="Griggsy_0-1646904682271.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;converted into:&lt;/P&gt;&lt;P&gt;[ {&lt;/P&gt;&lt;P&gt;"sig" : "0",&lt;/P&gt;&lt;P&gt;"arch" : "c000003e",&lt;/P&gt;&lt;P&gt;"syscall" : "87"&lt;/P&gt;&lt;P&gt;}]&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I'm aware this can be done using regex to create attributes and then attributeToJson but some of my logs have hundreds of key value pairs so that's not an option, there must be a way to convert it using record processing? i.e convertRecord&lt;/P&gt;</description>
    <pubDate>Thu, 10 Mar 2022 09:37:34 GMT</pubDate>
    <dc:creator>Griggsy</dc:creator>
    <dc:date>2022-03-10T09:37:34Z</dc:date>
  </channel>
</rss>

