Hi Arran, Thanks for your reply. It works now. I had to compile and enable rest module because jsonquote is an xlat command provided by rest I consider now this post as solved. Thanks all for your help Cedric Le 15/05/2017 à 18:08, Arran Cudbard-Bell a écrit :
On May 10, 2017, at 11:29 AM, cedric delaunay <cedric.delaunay@univ-rennes1.fr> wrote:
Le 24/01/2017 à 13:22, Matthew Newton a écrit :
On Tue, Jan 24, 2017 at 10:52:32AM +0000, A.L.M.Buxey@lboro.ac.uk wrote:
use Module-Failure-Message - but also look at the 3.0.x HEAD from git or wait until 3.0.13 comes out as Matthew has ensures theres a good starting point for the ELK crowd :) Yeah, to be honest rather than trying to write out JSON with linelog personally I'd just look at reading the plain detail files with logstash and using that to write them out as JSON. You might be fine, but then some joker will come along and try to log in with a username like 'silly"json'...
Should probably at least wrap all the attributes in %{jsonquote:...} to be safe.
"rlm_jsonlog" is something I've thought about for a while. Just not sure it's worth it. Might be if I can then use that to feed directly into elasticsearch and skip the logstash bit.
Matthew
I Matthew, Linelog/jon solution is pretty operational but as you have guessed it, I have problems with "\" in attributes. You talked about jsonquote but I can't find how use it. It's an xlat, just us "%{jsonquote:<string>}" as part of your linelog fmt string.
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Cédric Delaunay Direction des Systèmes d'Informations Equipe Réseau & Telephonie 263, Avenue du Général Leclerc Tel: 02 23 23 71 59 CS 74205 - 35042 Rennes Cedex Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse http://ent.univ-rennes1.fr