{"action":"created","issue":{"url":"https://api.github.com/repos/rsyslog/rsyslog/issues/483","labels_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/483/labels{/name}","comments_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/483/comments","events_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/483/events","html_url":"https://github.com/rsyslog/rsyslog/issues/483","id":101066429,"number":483,"title":"imjournal: Add ability to filter on journal _TRANSPORT","user":{"login":"opoplawski","id":814662,"avatar_url":"https://avatars.githubusercontent.com/u/814662?v=3","gravatar_id":"","url":"https://api.github.com/users/opoplawski","html_url":"https://github.com/opoplawski","followers_url":"https://api.github.com/users/opoplawski/followers","following_url":"https://api.github.com/users/opoplawski/following{/other_user}","gists_url":"https://api.github.com/users/opoplawski/gists{/gist_id}","starred_url":"https://api.github.com/users/opoplawski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/opoplawski/subscriptions","organizations_url":"https://api.github.com/users/opoplawski/orgs","repos_url":"https://api.github.com/users/opoplawski/repos","events_url":"https://api.github.com/users/opoplawski/events{/privacy}","received_events_url":"https://api.github.com/users/opoplawski/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rsyslog/rsyslog/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-14T17:57:00Z","updated_at":"2015-08-22T03:17:15Z","closed_at":null,"body":"See https://github.com/systemd/systemd/issues/959 for background.  We may be needing a way to filter out _TRANSPORT=audit messages from the journal."},"comment":{"url":"https://api.github.com/repos/rsyslog/rsyslog/issues/comments/133630295","html_url":"https://github.com/rsyslog/rsyslog/issues/483#issuecomment-133630295","issue_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/483","id":133630295,"user":{"login":"davidelang","id":2208335,"avatar_url":"https://avatars.githubusercontent.com/u/2208335?v=3","gravatar_id":"","url":"https://api.github.com/users/davidelang","html_url":"https://github.com/davidelang","followers_url":"https://api.github.com/users/davidelang/followers","following_url":"https://api.github.com/users/davidelang/following{/other_user}","gists_url":"https://api.github.com/users/davidelang/gists{/gist_id}","starred_url":"https://api.github.com/users/davidelang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidelang/subscriptions","organizations_url":"https://api.github.com/users/davidelang/orgs","repos_url":"https://api.github.com/users/davidelang/repos","events_url":"https://api.github.com/users/davidelang/events{/privacy}","received_events_url":"https://api.github.com/users/davidelang/received_events","type":"User","site_admin":false},"created_at":"2015-08-22T03:17:15Z","updated_at":"2015-08-22T03:17:15Z","body":"we already have very extensive ability to filter logs, as long as the jounral_transport is one of the fields that we have available to filter on, we should be  able to filter it without adding new options.\r\n\r\nI don't see there being much value in filtering it in the input module instead of in the main log processing loop. You would save a little load, but it really breaks the layering model we have.\r\n\r\nIf we don't get this info from the journal, then there is a problem.\r\n\r\nIf the journal is sending us the data and not passing this info along, then it's the journal's fault. The journal really should have an option to send the data to rsyslog in JSON so that all the metadata is preserved (but I wouldn't hold my breath on this, given their hostility towards interoperability). In this case we have no way to filter on this because we never see it.\r\n\r\nIf we are fetching from the journal and not extracting this field into our JSON data, it's our faulr. If we do extract it, existing filtering will work."}}