Welcome! Log In Create A New Profile

Advanced

how to Remove access_log prefix in syslog (json format)

how to Remove access_log prefix in syslog (json format)
November 16, 2020 07:15AM
Hi
I wanna try to send access_log via syslog in json format!
this is my configuration!

log_format graylog_format escape=json $request_final_log;
access_log syslog:server=w.x.y.z:port,tag=,nohostname graylog_format;


$request_final_log is a nginx variable which contains my json data at log phase but at final step, I can capture output data which has : character at start of json and I can't remove it. so my json parsing won't be successful and all of double quotation are escaped like : {\"id\":\"a2356\"}
can I remove prefix : character using nginx logs_format or ...?
thanks a lot...
Best,
Hadi



Edited 1 time(s). Last edit at 11/16/2020 07:17AM by HadiAbbasiProgrammer.
Re: how to Remove access_log prefix in syslog (json format)
November 17, 2020 05:18AM
we can set escape= none to disable escaping double quotations but by a command like this:

log_format graylog_format escape=none $request_final_log;
access_log syslog:server=w.x.y.z:port,tag=,nohostname graylog_format;

still there is a single Colon at the start of my message logs and it causes error on parsing json file without any extractor or regex checking in monitoring server! I wanna know if nginx prepares any command or config to remove all of prefixes in syslog messages?
in others words, I wanna send my logs as json without any prefix like:

{"reqid":"adfw2qwe",...}
{"reqid":"34fsasdsd",...}
{"reqid":"3d34fwffsf",...}

but for now, it sends:

: {"reqid":"adfw2qwe",...}
: {"reqid":"34fsasdsd",...}
: {"reqid":"3d34fwffsf",...}
Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 81
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready