Specifying data types in value-pairs
By default, syslog-ng OSE handles every data as strings. However, certain destinations and data formats (for example, SQL, MongoDB, JSON
|
|
Caution:
Hazard of data loss! If syslog-ng OSE cannot convert the data into the specified type, an error occurs, and syslog-ng OSE drops the message by default. To change how syslog-ng OSE handles data-conversion errors, see on-error(). |
To use type-hinting, enclose the macro or template containing the data with the type: <datatype>("<macro>"), for example: int("$PID").
Currently the mongodb() destination and the format-json template function supports data types.
Example: Using type-hinting
The following example stores the MESSAGE, PID, DATE, and PROGRAM fields of a log message in a MongoDB database. The DATE and PID parts are stored as numbers instead of strings.
mongodb(
value-pairs(pair("date", datetime("$UNIXTIME"))
pair("pid", int64("$PID"))
pair("program", "$PROGRAM"))
pair("message", "$MESSAGE"))
)
);
The following example formats the same fields into JSON.
$(format-json date=datetime($UNIXTIME) pid=int64($PID) program=$PROGRAM message=$MESSAGE)
The syslog-ng OSE application currently supports the following data-types.
-
boolean: Converts the data to a boolean value. Anything that begins with a t or 1 is converted to true, anything that begins with an f or 0 is converted to false.
-
datetime: Use it only with UNIX timestamps, anything else will likely result in an error. This means that currently you can use only the $UNIXTIME macro for this purpose.
-
double: A floating-point number.
-
literal: The data as a literal string, without adding any quotes or escape characters.
-
int or int32: 32-bit integer.
-
int64: 64-bit integer.
-
string: The data as a string.