Skip to content

Support journald -ojson output #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jul 8, 2023
Merged

Support journald -ojson output #30

merged 3 commits into from
Jul 8, 2023

Conversation

koenbollen
Copy link
Owner

This pull request adds support for journald's -ojson output.

Example:

$ journald -xe -ojson | jl
[2023-06-16 12:51:36]  NOTICE: Invalid user hacker from 127.106.119.170 port 54520 [SYSLOG_FACILITY=3 SYSLOG_IDENTIFIER=sshd _CAP_EFFECTIVE=1ffffffffff _CMDLINE=sshd: unknown [priv] _COMM=sshd _EXE=/usr/sbin/sshd _GID=0 _HOSTNAME=example.org _PID=1977203 _SYSTEMD_SLICE=system.slice _SYSTEMD_UNIT=sshd.service _TRANSPORT=stdout _UID=0]
[2023-06-16 12:51:37]    INFO: Disconnected from invalid user hacker 127.106.119.170 port 54520 [preauth] [SYSLOG_FACILITY=3 SYSLOG_IDENTIFIER=sshd _CAP_EFFECTIVE=1ffffffffff _CMDLINE=sshd: unknown [priv] _COMM=sshd _EXE=/usr/sbin/sshd _GID=0 _HOSTNAME=example.org _PID=1977203 _SYSTEMD_SLICE=system.slice _SYSTEMD_UNIT=sshd.service _TRANSPORT=stdout _UID=0]

(see examples/journald.md for the before/after comparison)

Technical change: This change also introduces processors in the code which allows us to make very specific changes for certain structured logging formats.

Closes #28

@koenbollen
Support journald -ojson output
42991b8 
This change introduces processors for specific output and the processor
for journald.
The journald processor will parse __REALTIME_TIMESTAMP and PRIORITY make
the log entries compatible with normal jl output.
@koenbollen koenbollen merged commit 83211ab into master Jul 8, 2023
@koenbollen koenbollen deleted the support-journald branch July 8, 2023 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

jl can't decode journald format?
1 participant
@koenbollen