You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
remove json parsing from SystemdJournal2Gelf - let users configure this themselves as a pipeline. Steps to recreate this as a custom pipeline:
Go to /system/pipelines in your graylog install and create a new pipeline
Edit the new pipeline and add a stage:
In the first stage, add a rule to interpret the message as json:
rule "interpret message as JSON"
when
has_field("message") && starts_with(to_string($message.message), "{\"")
then
let json = parse_json(to_string($message.message));
let map = to_map(json);
set_fields(map);
rename_field("Message", "message");
rename_field("FullMessage", "full_message");
end
you can prefix additional stages to cleanup your message eg. when receiving messages from php-fpm:
rule "strip fpm pool prefix"
when
has_field("message") && starts_with(to_string($message.message), "pool ")
then
set_field("message", regex_replace("^pool [a-zA-Z_\\[\\d\\]]+: ", to_string($message.message), ""));
end
attach the pipeline to the appropriate stream(s). Make sure the Pipeline Processor is configured afterMessage Filter Chain in system/configurations
The text was updated successfully, but these errors were encountered:
Hi @SjonHortensius just found this by accident.
I think the README.md requires updating, so people don't expect this JSON parsing to happen automatically.
remove
json
parsing fromSystemdJournal2Gelf
- let users configure this themselves as a pipeline. Steps to recreate this as a custom pipeline:Go to
/system/pipelines
in your graylog install and create a new pipelineEdit the new pipeline and add a stage:
In the first stage, add a rule to interpret the message as json:
php-fpm
:Pipeline Processor
is configured afterMessage Filter Chain
insystem/configurations
The text was updated successfully, but these errors were encountered: