outputjson
Exports the value of a specific field in JSON format. Each JSON record is separated by a newline.
Syntax
Required Parameter
FILE_PATH
- Path to JSON file.
Optional Parameter
append=BOOL
-
Enables or disables appending data to the end of the file specified in the
FILE_PATH
(default:f
).t
: Appends the field records to the end of the file specified asFILE_PATH
. You cannot set this option tot
whenoverwrite=t
.f
: NOT append the field records to the end of the file specified asFILE_PATH
. The query fails if the file exists.
encoding=CHARSET
-
Character set (default: utf-8). Use the preferred MIME name or aliases registered in the following document: http://www.iana.org/assignments/character-sets/character-sets.xhtml
flush=INT{y|mon|w|d|h|m|s}
-
Cycle to flush the output buffer to the file specified as
FILE_PATH
and to flush buffer. You can use one of the cycle units ofy
(year),mon
(month),w
(week),d
(day),h
(hour),m
(minute), ands
(second). For example, to flush the buffer every 5 seconds, specify5s
. overwrite=BOOL
-
Option to enable overwriting the file specified as
FILE_PATH
, if it exists (default:f
).t
: Overwrites the file specified asFILE_PATH
, if it exists. You cannot set this option tot
when theappend=t
.f
: NOT overwrite the file specified asFILE_PATH
, if it exists. The query fails if the file exists.
partition=BOOL
-
Option to enable macro in the
FILE_PATH
(default:f
).t
: Enables macrof
: Disables macro
-
You can specify
FILE_PATH
to change the directory and file path over time using a macro whenpartition=t
. The available macros are{logtime:FMT}
and{now:FMT}
. For input examples, refer to Usage #3.{logtime:FMT}
: Names the directory or file based on the log occurrence time.{now:FMT}
: Names the directory or file based on the current time.
CautionIf you set 'partition=t' and do not use a macro on the path, the query fails.
tmp=TMP_FILE_PATH
-
Path to a temporary file. Once you set this option, the command creates a temporary file and outputs the result, and moves the file to the path specified by
FILE_PATH
when the query finishes successfully. FIELD, ...
-
Fields to be output in the JSON file, separated by a comma(
,
) (default: all fields).
Usage
-
Record all fields in the
output.json
fileoutputjson /opt/logpresso/files/output.json
-
Record
src_ip
anddst_ip
in theippair.json
fileoutputjson /opt/logpresso/files/ippair.json src_ip, dst_ip
-
Partition the directory according to the log occurrence date using macro, create the file name based on the current time, and then record the
src_ip
anddst_ip
field values.outputjson partition=t /opt/logpresso/files/{logtime:/yyyy/MM/dd/}/{now:HHmm}.json src_ip, dst_ip