Hi everyone,
I'm trying to create a logging policy to send the proxy logs via Syslog to Logstash as illustrated below:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<MessageLogging async="false" continueOnError="true" enabled="true" name="Logstash-syslog">
<DisplayName>Logstash-syslog</DisplayName>
<Syslog>
<Message>{"Request":"{request.content}","Response":"{response.content}"}</Message>
<Host>host</Host>
<Port>port</Port>
<Protocol>TCP</Protocol>
</Syslog>
</MessageLogging>
My issue is that the request and response values may contain line breaks (if the message spans across multiple lines), which breaks the logging message into multiple fragments (a fragment for each line break) and sends each fragment as a separate Syslog event. It is also impossible to reconstruct the message upon reception in Logstash because the Syslog port is receiving a lot of events from different sources, which doesn't guarantee the order of the fragments.
Please let me know if there is a way to fix this in the Logging Policy itself so that all the line-breaks and whitespaces can be replaced or removed before sending the payload to the Syslog port.
Much thanks!
LinkedIn
Twitter
