• Linux
• Rsyslog
• Json

Linux/Rsyslog/Json

• Why ? Structured fields.

Parse incoming json

• Msg should start with  CEE: { } 

• Use module mmjsonparse

  module(load="mmjsonparse") #for parsing CEE-enhanced syslog messages
  #try to parse a structured log
  *.* :mmjsonparse:

  Json Format