@Griggsy ,
Instead of using the ParseSyslog processor, try using ParseSyslog5424, which has a closer implementation to the RFC 5424 standard.
When you use ParseSyslog5424, the attributes in the structured data part of of the syslog message are parsed and added to the flowfiles as attributes. For example, the following syslog message:
<35>1 2013-10-11T22:14:15.003Z client_machine su - - [SDID@0 utilization="high" os="linux"] 'su root' failed for joe on /dev/pts/2
Will yield a flowfile including the following attributes:
Cheers,
André
Thanks André
What if I wanted to turn the key value pairs separated by '=' in json content as in the original question? for instance the following syslog:
converted into:
[ {
"sig" : "0",
"arch" : "c000003e",
"syscall" : "87"
}]
I'm aware this can be done using regex to create attributes and then attributeToJson but some of my logs have hundreds of key value pairs so that's not an option, there must be a way to convert it using record processing? i.e convertRecord
Hi @Griggsy ,
You don't need to use regex for this. You can, for example, connect the output of the ParseSyslog5424 directly to the following AttributesToJson processor:
The output of this will be a JSON like the one below:
{
"syslog.structuredData.SDID@0.os" : "linux",
"syslog.structuredData.SDID@0.utilization" : "high"
}You can then use a JoltTransformJSON process to transform the above into your final product. For example, the following JOLT specification:
[
{
"operation": "shift",
"spec": {
"syslog.structuredData.*.*": {
"@": "&(1,2)"
}
}
}
]
Will produce the following output:
{
"os" : "linux",
"utilization" : "high"
}
This is the flow:
Cheers,
André
--
Was your question answered? Please take some time to click on "Accept as Solution" below this post.
If you find a reply useful, say thanks by clicking on the thumbs up button.
