Le 24/01/2017 à 13:22, Matthew Newton a écrit :
On Tue, Jan 24, 2017 at 10:52:32AM +0000, A.L.M.Buxey@lboro.ac.uk wrote:
use Module-Failure-Message - but also look at the 3.0.x HEAD from git or wait until 3.0.13 comes out as Matthew has ensures theres a good starting point for the ELK crowd :) Yeah, to be honest rather than trying to write out JSON with linelog personally I'd just look at reading the plain detail files with logstash and using that to write them out as JSON. You might be fine, but then some joker will come along and try to log in with a username like 'silly"json'...
Should probably at least wrap all the attributes in %{jsonquote:...} to be safe.
"rlm_jsonlog" is something I've thought about for a while. Just not sure it's worth it. Might be if I can then use that to feed directly into elasticsearch and skip the logstash bit.
Matthew
I Matthew, Linelog/jon solution is pretty operational but as you have guessed it, I have problems with "\" in attributes. You talked about jsonquote but I can't find how use it. Should I load "rest" module and web server associated or can I juste use jsonquote in linelog syntax ? Do somebody have a small howto aviable ? Thanks Cedric -- Cédric Delaunay Direction des Systèmes d'Informations Equipe Réseau & Telephonie 263, Avenue du Général Leclerc Tel: 02 23 23 71 59 CS 74205 - 35042 Rennes Cedex Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse http://ent.univ-rennes1.fr