nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Christopher Wilson <>
Subject ReplaceText duplicates
Date Thu, 10 Sep 2015 15:00:56 GMT
I've ran into an issue with ReplaceText on another thread but thought I'd
move this over to it's own.

What I have is a syslog entry from OpenStack that contains CADF (Cloud
Audit Data Federation) JSON as the payload.  In the context of OpenStack
these are login/security events that we'd like to see outside of a normal
syslog stream and passed directly over to the security team.  I'd started
down the path of ExtractText and pulling out the associated JSON into an
attribute but found when I wired in a ReplaceText and tried to replace the
content with the attribute 3 copies of the JSON data were written to the
file content.

What I've since learned is I can just replace the text in place without
yanking into an attribute.  However, I can see cases where I might want to
replace/append text using one or more attributes.  Wanted to see if other
have handled this differently and if there is an enhancement request in the

I put the template I was working from, with a line of the syslog data, up
on GitHub in case anyone wants to see this behavior in action.  You just
have to play with turning processors on/off when viewing the full bulletin

Thanks in advance.


View raw message