linelog best practice

cedric delaunay cedric.delaunay at
Wed May 17 17:03:01 CEST 2017

Hi Arran,
Thanks for your reply.

It works now.
I had to compile and enable rest module because jsonquote is an xlat 
command provided by rest

I consider now this post as solved.
Thanks all for your help

Le 15/05/2017 à 18:08, Arran Cudbard-Bell a écrit :
>> On May 10, 2017, at 11:29 AM, cedric delaunay <cedric.delaunay at> wrote:
>> Le 24/01/2017 à 13:22, Matthew Newton a écrit :
>>> On Tue, Jan 24, 2017 at 10:52:32AM +0000, A.L.M.Buxey at wrote:
>>>> use Module-Failure-Message  - but also look at the 3.0.x HEAD from git or wait until 3.0.13
>>>> comes out as Matthew has ensures theres a good starting point for the ELK crowd  :)
>>> Yeah, to be honest rather than trying to write out JSON with
>>> linelog personally I'd just look at reading the plain detail files
>>> with logstash and using that to write them out as JSON. You might
>>> be fine, but then some joker will come along and try to log in
>>> with a username like 'silly"json'...
>>> Should probably at least wrap all the attributes in
>>> %{jsonquote:...} to be safe.
>>> "rlm_jsonlog" is something I've thought about for a while. Just
>>> not sure it's worth it. Might be if I can then use that to feed
>>> directly into elasticsearch and skip the logstash bit.
>>> Matthew
>> I Matthew,
>> Linelog/jon solution is pretty operational but as you have guessed it, I have problems with "\" in attributes.
>> You talked about jsonquote but I can't find how use it.
> It's an xlat, just us "%{jsonquote:<string>}" as part of your linelog fmt string.
> -Arran
> -
> List info/subscribe/unsubscribe? See

Cédric Delaunay			Direction des Systèmes d'Informations
Equipe Réseau & Telephonie	263, Avenue du Général Leclerc
Tel: 02 23 23 71 59		CS 74205 - 35042 Rennes Cedex

Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3610 bytes
Desc: Signature cryptographique S/MIME
URL: <>

More information about the Freeradius-Users mailing list