The logging system we use can ingest log files very easily if they are formatted as JSON, so I would like to specify a custom format in my config.
This is the sort of thing I would like to set it to:
{"@timestamp": "{when_iso}", "remote": "{remote}", "method": "{method}", "uri": "{uri}", "proto": "{proto}", "status": "{status}", "size": "{size}"}
But I’m not sure what the syntax in a Caddyfile is to escape the quotes, or if the extra { and } will interfere with the tag parser.
Okay, I guessed the quote escape scheme to be \" and that works fine, but as suspected from how replacer.go does it’s business, having any opening curly braces in the format string that aren’t actual replaceable tokens breaks it.
This works, but is missing the final part, which is surrounding each row with { and }:
log / /var/log/caddy/access.log "\"@timestamp\": \"{when_iso}\", \"remote\": \"{remote}\", \"method\": \"{method}\", \"uri\": \"{uri}\", \"proto\": \"{proto}\", \"status\": \"{status}\", \"size\": \"{size}\""The replacer file will need to be modified so that { and } can be escaped like quotes are. You could open an issue to request this feature, that we won’t forget about it. 
Sounds like a plan. Once I get the hang of Go and running tests, I can probably submit a pr for that sort of fix too.
Worth noting that even in this instance it seems possible that the {uri} value might not be correct escaped to be a valid JSON escaped string. e.g. if I request uri /?\ (valid) caddy logs the same string, but in JSON that would be "uri":"/?\", which is not valid JSON.
True. Guess it really might need a proper json format config option.
What about writing a small script to “prepare” a JSON version of the Caddy log for ingestion? Can’t imagine it would be too difficult, the Caddy logs being quite predictable, but I can’t say I’ve ever needed to so I might be wrong.
Yeah. It’s a bit of a pain though - you have to allow for all sorts of things like log files being rotated out from under you etc. Might just stick to plain text for now.
I could keep passing the logs through Logstash, which is designed to to some manipulation of log lines before passing to ElasticSearch, but I was hoping to remove that service from my environment. I may not be able to.
