diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf index f1bbb05..8ef6b8a 100644 --- a/package/etc/conf.d/conflib/_common/templates.conf +++ b/package/etc/conf.d/conflib/_common/templates.conf @@ -71,7 +71,7 @@ template t_hdr_sdata_msg { }; # =============================================================================================== -# JSON; for JSON pretty-printing (for debugging) +# JSON_3164; for JSON pretty-printing (for debugging) # =============================================================================================== template t_JSON_3164 { @@ -85,17 +85,30 @@ template t_JSON_3164 { }; # =============================================================================================== -# JSON; for JSON pretty-printing (for RFC5424) +# JSON_5424; for JSON pretty-printing (standard output for RFC5424 messages in production) +# Fields passed as indexed fields or as Splunk metadata are excluded # =============================================================================================== template t_JSON_5424 { template('$(format-json --scope rfc5424 - --key MESSAGE + --key RAWMSG --exclude DATE --exclude FACILITY --exclude PRIORITY --exclude HOST - --exclude RAWMSG + )'); + }; + +# =============================================================================================== +# JSON_5424_ALL; for JSON pretty-printing (for printing all fields in RFC5424 message and ISO date) +# Useful for log path development +# =============================================================================================== + +template t_JSON_5424_ALL { + template('$(format-json --scope rfc5424 + --exclude DATE + --key ISODATE + --key RAWMSG )'); };