Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wrong json format produced message with single quote #18

Open
zjxlinux opened this issue May 30, 2018 · 0 comments
Open

wrong json format produced message with single quote #18

zjxlinux opened this issue May 30, 2018 · 0 comments

Comments

@zjxlinux
Copy link

Description

When i am using syslog-ng and syslogng-kafka to push system logs to kafka Server. I notice that the messages are not json format, messages use single quote (which should be double-quotes ) and can not be recognized and parsed by logstash

reproduce

I use syslog-ng -F to debug and the logs be produced like this

1 2018-05-30T13:57:14.721616+08:00 www.test.com syslogng_kafka 32288 - - Message produced: {'FACILITY': 'cron', 'PRIORITY': 'info', 'HOST': 'www.test.com', 'PROGRAM': 'CROND', 'DATE': '1527659821', 'MESSAGE': '(root) CMD (/usr/lib64/sa/sa1 1 1)'}

On logstash server i received the _jsonparsefailure error
image

syslog-ng conf

source s_sys {
    file ("/proc/kmsg" program_override("kernel: "));
    unix-stream ("/dev/log" max-connections(512));
    internal();
};
destination syslog_to_kafka {
    python(
        class("syslogng_kafka.kafkadriver.KafkaDestination")
            on-error("fallback-to-string")
            options(
                hosts("xxx:9092")
                topic("system-log")
                verbose("True")
                display_stats("True")
                )
    );
};
log {
    source(s_sys);
    destination(syslog_to_kafka);
};

logstash conf

input {
  kafka {
    bootstrap_servers => "xxxx:9092"
    topics => ["system-log"]
    codec => json
  }
}
......
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant