1
response
response
nxlog-ce-2.9.1716 Ubuntu 16.04 LTS (OS)
I am trying to parse JSON to SYSLOG
There are two issues. 1. the NoCache TRUE does not seem to work. (I also tried SavePOS false) and it always caches the file.
- When I do get it to work; it uses the localhost (which is not where the logs are from) and the time/date stamp from the JSON file (but no other data is there).
Is there an example of parsing JSON to _syslog_bsd()? for forwarding to a SEIM
#######################################
# Global directives #
########################################
User nxlog
Group nxlog
LogFile /var/log/nxlog/nxlog.log
LogLevel DEBUG
NoCache TRUE
########################################
# Modules #
########################################
<Extension _json>
Module xm_json
</Extension>
<Extension syslog>
Module xm_syslog
</Extension>
<Input in>
SavePos FALSE
Module im_file
File '/tmp/json/*.json'
Exec $Message = to_json(); to_syslog_bsd();
</Input>
<Output fileout1>
Module om_file
File "/var/log/nxlog/syslog.log"
Exec to_syslog_bsd();
</Output>
########################################
# Routes #
########################################
<Route 1>
Path in => fileout1
</Route>
resulting output is
<13>Feb 16 02:43:14 [redacted hostname] {"EventReceivedTime":"2018-02-16 02:43:14","SourceModuleName":"in","SourceModuleType":"im_file"}
Date is localtime for the conversion
Source JSON is OKTA logs