outputjson

Exports the value of a specific field in JSON format. Each JSON record is separated by a newline.

Syntax

outputjson [OPTIONS] FILE_PATH [FIELD, ...]
Required Parameter
FILE_PATH
Path to JSON file.
Optional Parameter
append=BOOL

Enables or disables appending data to the end of the file specified in the FILE_PATH (default: f).

  • t: Appends the field records to the end of the file specified as FILE_PATH. You cannot set this option to t when overwrite=t.
  • f: NOT append the field records to the end of the file specified as FILE_PATH. The query fails if the file exists.
encoding=CHARSET

Character set (default: utf-8). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml

flush=INT{y|mon|w|d|h|m|s}

Cycle to flush the output buffer to the file specified as FILE_PATH and to flush buffer. You can use one of the cycle units of y (year), mon (month), w (week), d (day), h (hour), m (minute), and s (second). For example, to flush the buffer every 5 seconds, specify 5s.

overwrite=BOOL

Option to enable overwriting the file specified as FILE_PATH, if it exists (default:f).

  • t: Overwrites the file specified as FILE_PATH, if it exists. You cannot set this option to t when the append=t.
  • f: NOT overwrite the file specified as FILE_PATH, if it exists. The query fails if the file exists.
partition=BOOL

Option to enable macro in the FILE_PATH (default: f).

  • t: Enables macro
  • f: Disables macro

You can specify FILE_PATH to change the directory and file path over time using a macro when partition=t. The available macros are {logtime:FMT} and {now:FMT}. For input examples, refer to Usage #3.

  • {logtime:FMT}: Names the directory or file based on the log occurrence time.
  • {now:FMT}: Names the directory or file based on the current time.
Caution
If you set 'partition=t' and do not use a macro on the path, the query fails.
tmp=TMP_FILE_PATH

Path to a temporary file. Once you set this option, the command creates a temporary file and outputs the result, and moves the file to the path specified by FILE_PATH when the query finishes successfully.

FIELD, ...

Fields to be output in the JSON file, separated by a comma(,) (default: all fields).

Usage

  1. Record all fields in the output.json file

    outputjson /opt/logpresso/files/output.json
    
  2. Record src_ip and dst_ip in the ippair.json file

    outputjson /opt/logpresso/files/ippair.json src_ip, dst_ip
    
  3. Partition the directory according to the log occurrence date using macro, create the file name based on the current time, and then record the src_ip and dst_ip field values.

    outputjson
        partition=t
        /opt/logpresso/files/{logtime:/yyyy/MM/dd/}/{now:HHmm}.json
        src_ip, dst_ip