I've read through the guide: http://www.rsyslog.com/tag/cee-enhanced/ I can't seem to get this example to work in the real world: http://pastebin.com/AGPfCDgV
Adding or removing: module(load="mmjsonparse") *.* :mmjsonparse: Seems to have zero impact, as it would seem it's imjournal is the one that builds this json object?: https://github.com/rsyslog/rsyslog/blob/v8.17.0/plugins/imjournal/imjournal.c#L207 https://github.com/rsyslog/rsyslog/blob/v8.17.0/runtime/msg.c#L4485 Thanks in advanced! Alan Scherger _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

