[rsyslog] Some list templates with mmjsonparse try to get 2GB of RAM or give OOM

Radu Gheorghe radu0gheorghe at gmail.com
Mon Jan 7 15:46:46 CET 2013


Wow, that was fast! Thanks, Rainer!

Regarding the related questions:
- please let me know if there's any issue with using $!all-json. I would
need to use it to handle with CEE-enhanced and "regular" logs with the same
template - and output a JSON. Something like:

template(name="testTemplate"
         type="list") {
           constant(value="{")
           constant(value="\"@timestamp\":\"")
           property(name="timereported" dateFormat="rfc3339")
           constant(value="\",")
           property(name="$!all-json" position.from="2")
         }

I can work around that with 2 templates and %parsesuccess%, but I find the
solution above much nicer.

As for contributions to the documentation: how can I actually do that?
Let's say I would want to contribute some changes to this page:
http://www.rsyslog.com/doc/property_replacer.html

I mean, I only know how to do pull requests on github. In this case I
should simply download the html, change it and send the back the diff?

Thanks and best regards,
Radu


More information about the rsyslog mailing list