From 16b24c211a35a0e67a22b6fd73a53bafd6df470c Mon Sep 17 00:00:00 2001
From: mbonsack <mbonsack@splunk.com>
Date: Tue, 9 Jun 2020 17:10:28 -0700
Subject: [PATCH] Fix `t_JSON_5424_SDATA` to exclude `MESSAGE`

---
 package/etc/conf.d/conflib/_common/templates.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf
index 8ef6b8a..92fb5f0 100644
--- a/package/etc/conf.d/conflib/_common/templates.conf
+++ b/package/etc/conf.d/conflib/_common/templates.conf
@@ -118,11 +118,11 @@ template t_JSON_5424_ALL {
 
 template t_JSON_5424_SDATA {
     template('$(format-json --scope rfc5424
-                --key MESSAGE
                 --exclude DATE
                 --exclude HOST
                 --exclude FACILITY
                 --exclude PRIORITY
+                --exclude MESSAGE
                 --exclude RAWMSG
                 )');
     };
@@ -130,4 +130,4 @@ template t_JSON_5424_SDATA {
 
 template t_snmp_trap {
     template('$(format-json .snmp.* --rekey .snmp.* --shift-levels 2)');
-    };
\ No newline at end of file
+    };