Member since
11-20-2017
1
Post
1
Kudos Received
0
Solutions
11-21-2017
04:58 PM
1 Kudo
Please help me to ingest the following syslog message in NIFI. (The syslog parse failed as it is unable to parse the syslog)
I want to convert the log into the following JSON format and even store the raw message in JSON
I want the parsing to be dynamic for example the key value should be automatically determined with the = delimeter and not static( where to write regex to for each and every attribute) . Log Message : 2017:11:20-21:11:53 firewall01 ulogd[25916]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="5" initf="ppp0" outitf="eth1" mark="0x3518" app="1304" srcmac="00:15:5d:65:1f:06" srcip="10.242.3.2" dstip="10.90.90.104" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="7554" dstport="8080" tcpflags="SYN" The Output : ( Manually created JSON ).
{
'"_time " : "2017:11:20-21:11:53 " , "hostname":"firewall01 ",
"logtype": " ulogd[25916]", "id":"2002", "severity":"info", "sys":"SecureNet",
"sub":"packetfilter",
"name":"Packet accepted", "action":"accept",
"fwrule":"5", "initf":"pp0", "outif":"eth1", "mark":"0x3518",
"app":"1304", "srcmac":"00:15:5d:65:1f:06", "srcip":"10.242.3.2",
"dstip":"10.90.90.104",
"proto":"6", "length":"52",
"tos":"0x00", "prec":"0x00",
"ttl":"127", "srcport":"7554", "dstport":"8080",
"tcpflags":"SYN",
"_raw" : "2017:11:20-21:11:53 firewall01 ulogd[25916]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="5" initf="ppp0" outitf="eth1" mark="0x3518" app="1304" srcmac="00:15:5d:65:1f:06" srcip="10.242.3.2" dstip="10.90.90.104" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="7554" dstport="8080" tcpflags="SYN" " }
... View more
Labels:
- Labels:
-
Apache NiFi