From dc15a9f1f2866d40818e800154ce213d24097316 Mon Sep 17 00:00:00 2001
From: Mark Bonsack <mbonsack@splunk.com>
Date: Thu, 7 May 2020 13:55:46 -0700
Subject: [PATCH] Update 5424 templates to include RAWMSG

* Update 5424 output templates to include RAWMSG.  Too confusing for most users without them, and there are some small parts of the message that are excluded (such as colons) that are needed to reassemble the raw message with the constituent macros.
---
 package/etc/conf.d/conflib/_common/templates.conf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf
index fc0c7a0..ce18953 100644
--- a/package/etc/conf.d/conflib/_common/templates.conf
+++ b/package/etc/conf.d/conflib/_common/templates.conf
@@ -80,6 +80,7 @@ template t_JSON_5424 {
     template('$(format-json --scope rfc5424
                 --pair PRI="<$PRI>"
                 --key ISODATE
+                --key RAWMSG
                 --exclude DATE
                 --exclude FACILITY
                 --exclude PRIORITY
@@ -95,6 +96,7 @@ template t_JSON_5424_SDATA {
     template('$(format-json --scope rfc5424
                 --pair PRI="<$PRI>"
                 --key ISODATE
+                --key RAWMSG
                 --exclude DATE
                 --exclude HOST
                 --exclude FACILITY