How to escape or remove double quotes in rsyslog template
- by Evgeny
I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings.
Problem is that values sometime include double-quotes themselves, and those need to be escaped - but I can't figure out how to do that.
Currently my rsyslog.conf contains this format that I use (a bit simplified):
$template JsonFormat,"{\"msg\":\"%msg%\",\"app-name\":\"%app-name%\"}\n",sql
But when a msg arrives that contains double quotes, the JSON is broken, example:
user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user="oracle" exe="/bin/su" (hostname=?, addr=?, terminal=?
result=Success)'
turns into:
{"msg":"user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user="oracle" exe="/bin/su" (hostname=?, addr=?, terminal=?
result=Success)'","app-name":"user"}
but what I need it to become is:
{"msg":"user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user=\"oracle\" exe=\"/bin/su\" (hostname=?, addr=?, terminal=?
result=Success)'","app-name":"user"}
