Syslog-ng format-json not working

Question

I'm desperately trying to send a message as JSON to a PHP script.

destination d_php {
program("/usr/bin/php -f /data/htdocs/log.php" template("$(format-json)\n")  ) ;
};

The php script is fine. Using simple macros works well, but the "format-json" function does always return this:

error in template: $(format-json)

I tried everything I could find in the documentation, but all response I get is "error in template". The official docs (link) even use 2 different spellings, not very promising.

Any ideas?

Answer 1

Found the reason. Apparently, syslog-ng is split into separate packages on Ubuntu (12). I had to install syslog-ng-mod-json.

It's really a shame that syslog-ng doesn't give the slightest hint that the function is missing or unknown, instead of some general error.

Answer 2

the format-json and format_json syntax should both work, hyphens and underscores are equivalent in syslog-ng. As for the actual problem, have you tried setting the scope parameter of format-json, like "$(format_json --scope selected_macros)"? By default, it is empty, which means there is nothing to format.

HTH,

Regards,

Robert Fekete

Answer 3

If you are compiling from the source, you shall install json-c library first (yum install json-c-devel).