2.12.1. Specifying data types in value-pairs The syslog-ng Premium Edition 7 Administrator Guide
By default, syslog-ng PE handles every data as strings. However, certain destinations and data formats (for example, SQL, MongoDB, JSON) support other types of data as well, for example, numbers or dates. The syslog-ng PE application allows you to specify the data type in templates (this is also called type-hinting). If the destination driver supports data types, it converts the incoming data to the specified data type. For example, this allows you to store integer numbers as numbers in MongoDB, instead of strings.
Hazard of data loss! If syslog-ng PE cannot convert the data into the specified type, an error occurs, and syslog-ng PE drops the message by default. To change how syslog-ng PE handles data-conversion errors, see Section on-error().
To use type-hinting, enclose the macro or template containing the data with the type:
<datatype>("<macro>"), for example:
mongodb() destination and the
format-json template function supports data types.
The syslog-ng PE application currently supports the following data-types.
boolean: Converts the data to a boolean value. Anything that begins with a
1is converted to true, anything that begins with an
0is converted to false.
datetime: Use it only with UNIX timestamps, anything else will likely result in an error. This means that currently you can use only the
$UNIXTIMEmacro for this purpose.
double: A floating-point number.
literal: The data as a literal string, without adding any quotes or escape characters.
int32: 32-bit integer.
int64: 64-bit integer.
string: The data as a string.