Merge pull request #441 from splunk/template/5424_RAWMSG

Update 5424 templates to include RAWMSG
CSVD · May 7, 2020 · 031b4f1 · 031b4f1
2 parents 9085ed4 + dc15a9f
commit 031b4f1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf
@@ -80,6 +80,7 @@ template t_JSON_5424 {
     template('$(format-json --scope rfc5424
                 --pair PRI="<$PRI>"
                 --key ISODATE
+                --key RAWMSG
                 --exclude DATE
                 --exclude FACILITY
                 --exclude PRIORITY
@@ -95,6 +96,7 @@ template t_JSON_5424_SDATA {
     template('$(format-json --scope rfc5424
                 --pair PRI="<$PRI>"
                 --key ISODATE
+                --key RAWMSG
                 --exclude DATE
                 --exclude HOST
                 --exclude FACILITY