4
responses

Hi, I have this type of input in nxlog.conf:

<Input udp>
    Module      im_udp
    Host        0.0.0.0
    Port        514
    Exec        parse_syslog(); to_json(); perl_call("process");
</Input>

My question is, how should I include that JSON output that I get from to_json() to my perl code? Should I write like this?:

my ( $event ) = @_;

Or it's only the output of parse_syslog_bsd() (as in example for xm_perl https://nxlog.co/documentation/nxlog-user-guide/xm_perl.html)? More generally, my question is how to include JSON output that i get from to_json() to perl code of xm_perl module?

AskedApril 3, 2020 - 11:11pm

Answer (1)

to_json() puts the result in the $raw_event field. You can access that from perl via the following:

my ( $event ) = @_;

my $json = Log::Nxlog::get_field($event, 'raw_event');

Comments (3)

  • EZ's picture

    Thanks, and after I make some transformation with $json, how to set it? So i changed that son file with some perl regular expressions with xm_perl, how to save this changed json?

  • EZ's picture

    Thanks, and after I make some transformation with $json, how to set it? So i changed that son file with some perl regular expressions with xm_perl, how to save this changed json?

    my code right now looks like this:

    use Log::Nxlog;
    use strict;
    use warnings;
    use feature 'say';
    use JSON;
    use utf8;
    
    
    sub rec2msg {
        my ( $event ) = @_;
        my $r = Log::Nxlog::get_field($event, 'raw_event');
        my $r = decode_json( $r );
        $r->{Message} = decode_json( $r->{Message} );
        my %IDs = ( "User awx01 logged in." => 1001 );
        my %levels = ( INFO => 4 );
        $r->{Message}{message} =~ /(\w+) (\w+) (.+)/;
    
        my($user,$msg) = ($2,"$1 $3");
        my $ID    = $IDs{$r->{Message}{message}};
        my $level = $levels{$r->{Message}{level}};
    
        my $out = "$r->{Message}{'@timestamp'} host CEF:0|OpenSource|AWX|7.0.0|$ID|$msg|$level|src=127.0.0.1 dst=$r->{MessageSourceAddress} duser=$user";
    
        return $out;
    }
    

    So $out is changed json, how to save it? Thanks in advance