results in ``` {"Datetime": "Fri Jun 18 15:18:30 2021","Packet-Type": "Access-Request","TLS-Cert-Issuer": null} ``` which is perfect. But when %{TLS-Client-Cert-Issuer} is filled it results in a not valid json file because it's not in quotes:
``` {"Datetime": "Fri Jun 18 15:18:30 2021","Packet-Type": "Access-Request","TLS-Cert-Issuer": /O=sample/OU=sample/CN=sample} ```
Does anyone have a idea how the contitional syntax could be used to get a quoted string when a variable is filled but a not quoted string 'null' when not?
No. you'd need to create the value outside of linelog, assign it to a temporary string, and then use that. If you wrap the assignment and linelog call in a policy, and then call the policy instead of linelog, that'd be the cleanest way to do what you want. -Arran