Chuck Chuck - 4 months ago 30
JSON Question

Syslog-ng format-json not working

I'm desperately trying to send a message as JSON to a PHP script.

destination d_php {
program("/usr/bin/php -f /data/htdocs/log.php" template("$(format-json)\n") ) ;
};


The php script is fine. Using simple macros works well, but the "format-json" function does always return this:


error in template: $(format-json)


I tried everything I could find in the documentation, but all response I get is "error in template". The official docs (link) even use 2 different spellings, not very promising.

Any ideas?

Answer

Found the reason. Apparently, syslog-ng is split into separate packages on Ubuntu (12). I had to install syslog-ng-mod-json.

It's really a shame that syslog-ng doesn't give the slightest hint that the function is missing or unknown, instead of some general error.