5

I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings.

Problem is that values sometime include double-quotes themselves, and those need to be escaped - but I can't figure out how to do that.

Currently my rsyslog.conf contains this format that I use (a bit simplified):

$template JsonFormat,"{\"msg\":\"%msg%\",\"app-name\":\"%app-name%\"}\n",sql

But when a msg arrives that contains double quotes, the JSON is broken, example:

user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user="oracle" exe="/bin/su" (hostname=?, addr=?, terminal=?
result=Success)'

turns into:

{"msg":"user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user="oracle" exe="/bin/su" (hostname=?, addr=?, terminal=?
result=Success)'","app-name":"user"}

but what I need it to become is:

{"msg":"user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user=\"oracle\" exe=\"/bin/su\" (hostname=?, addr=?, terminal=?
result=Success)'","app-name":"user"}
Evgeny
  • 589
  • 5
  • 10

2 Answers2

2

As of rsyslog 4.6.2, it seems you can just use the json property option:

$template JsonFormat,"{\"msg\":\"%msg:::json%\",\"app-name:::json\":\"%app-name:::json%\"}\n",sql

See here for more details.

Flimzy
  • 2,375
  • 17
  • 26
  • 1
    Unfortunately that doesn't work with 5.8.10 (although rsyslog doesn't complain about it); at least, it doesn't escape double quotes. – blalor Jan 03 '15 at 13:48
0

I found an extremely ugly solution to this, that I would gladly replace with something sensible:

$template JsonFormat,"{\"rawmsg\":\"%rawmsg:R,BRE,1,BLANK,0:\([^\"]*\)\"*--end%%rawmsg:R,BRE,1,BLANK,1:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,2:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,3:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,4:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,5:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,6:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,7:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,8:\([^\"]*\)\"--end%%rawmsg:R,BRE,1,BLANK,9:\([^\"]*\)\"--end%\",\"msg\":\"%msg:R,BRE,1,BLANK,0:\([^\"]*\)\"*--end%%msg:R,BRE,1,BLANK,1:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,2:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,3:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,4:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,5:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,6:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,7:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,8:\([^\"]*\)\"--end%%msg:R,BRE,1,BLANK,9:\([^\"]*\)\"--end%\",\"hostname\":\"%hostname%\",\"fromhost\":\"%fromhost%\",\"syslogtag\":\"%syslogtag%\",\"programname\":\"%programname%\",\"priority\":\"%pri%\",\"priority-text\":\"%PRI-text%\",\"infounittype\":\"%iut%\",\"syslogfacility\":\"%syslogfacility%\",\"syslogfacility-text\":\"%syslogfacility-text%\",\"syslogseverity\":\"%syslogseverity%\",\"syslogseverity-text\":\"%syslogseverity-text%\",\"timegenerated\":\"%timegenerated%\",\"timereported\":\"%timereported%\",\"app-name\":\"%app-name%\",\"procid\":\"%procid%\",\"msgid\":\"%msgid%\"}\n"

What it does it cuts the string into pieces using regular expressions, and then pastes them together with the double quotes removed - also limited to just 10 double quotes in a message.

Evgeny
  • 589
  • 5
  • 10