python/jc
1
0
Fork 0
mirror of https://github.com/kellyjonbrazil/jc.git synced 2025-07-15 01:24:29 +02:00
Code Issues Releases Activity

add schema docs

Browse Source
This commit is contained in:
Kelly Brazil
2022-08-16 17:12:09 -07:00
parent 5f43abc908
commit e777992b3e
2 changed files with 48 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
docs/parsers/syslog_s.md
View File

@ -33,7 +33,25 @@ Usage (module):
Schema: Schema:
{ {
"foo": string, "priority": integer,
"version": integer,
"timestamp": string,
"timestamp_epoch": integer, # [0]
"timestamp_epoch_utc": integer, # [1]
"hostname": string,
"appname": string,
"proc_id": integer,
"msg_id": string,
"structured_data": [
{
"identity": string,
"parameters": {
"<key>": string
}
}
],
"message": string,
"unparsable": string # [2]
# below object only exists if using -qq or ignore_exceptions=True # below object only exists if using -qq or ignore_exceptions=True
"_jc_meta": { "_jc_meta": {
@ -43,6 +61,11 @@ Schema:
} }
} }
[0] naive timestamp if "timestamp" field is parsable, else null
[1] timezone aware timestamp availabe for UTC, else null
[2] this field exists if the syslog line is not parsable. The value
is the original syslog line.
Examples: Examples:
$ cat syslog.txt | jc --syslog-s -p $ cat syslog.txt | jc --syslog-s -p

25
jc/parsers/syslog_s.py
View File

@ -28,7 +28,25 @@ Usage (module):
Schema: Schema:
{ {
"foo": string, "priority": integer,
"version": integer,
"timestamp": string,
"timestamp_epoch": integer, # [0]
"timestamp_epoch_utc": integer, # [1]
"hostname": string,
"appname": string,
"proc_id": integer,
"msg_id": string,
"structured_data": [
{
"identity": string,
"parameters": {
"<key>": string
}
}
],
"message": string,
"unparsable": string # [2]
# below object only exists if using -qq or ignore_exceptions=True # below object only exists if using -qq or ignore_exceptions=True
"_jc_meta": { "_jc_meta": {
@ -38,6 +56,11 @@ Schema:
} }
} }
[0] naive timestamp if "timestamp" field is parsable, else null
[1] timezone aware timestamp availabe for UTC, else null
[2] this field exists if the syslog line is not parsable. The value
is the original syslog line.
Examples: Examples:
$ cat syslog.txt | jc --syslog-s -p $ cat syslog.txt | jc --syslog-s -p