Hi
I wanna try to send access_log via syslog in json format!
this is my configuration!

log_format graylog_format escape=json $request_final_log;
access_log syslog:server=w.x.y.z:port,tag=,nohostname graylog_format;


$request_final_log is a nginx variable which contains my json data at log phase but at final step, I can capture output data which has : character at start of json and I can't remove it. so my json parsing won't be successful and all of double quotation are escaped like : {\"id\":\"a2356\"}
can I remove prefix : character using nginx logs_format or ...?
thanks a lot...
Best,
Hadi



Edited 1 time(s). Last edit at 11/16/2020 07:17AM by HadiAbbasiProgrammer.

we can set escape= none to disable escaping double quotations but by a command like this:

log_format graylog_format escape=none $request_final_log;
access_log syslog:server=w.x.y.z:port,tag=,nohostname graylog_format;

still there is a single Colon at the start of my message logs and it causes error on parsing json file without any extractor or regex checking in monitoring server! I wanna know if nginx prepares any command or config to remove all of prefixes in syslog messages?
in others words, I wanna send my logs as json without any prefix like:

{"reqid":"adfw2qwe",...}
{"reqid":"34fsasdsd",...}
{"reqid":"3d34fwffsf",...}

but for now, it sends:

: {"reqid":"adfw2qwe",...}
: {"reqid":"34fsasdsd",...}
: {"reqid":"3d34fwffsf",...}