From d7342edc4da26cb5ecf25fd4c0786155a3800d9d Mon Sep 17 00:00:00 2001 From: Mark Bonsack Date: Thu, 2 Jan 2020 10:22:25 -0800 Subject: [PATCH] Update docs for t_JSON_5424 template * Update docs to reflect minor change to t_JSON_5424 template --- docs/configuration.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/configuration.md b/docs/configuration.md index a650d7a..f19488b 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -209,7 +209,7 @@ Splunk Connect for Syslog utilizes the syslog-ng template mechanism to format th | t_legacy_hdr_msg | ${LEGACY_MSGHDR}${MESSAGE} | Useful for non-compliant syslog messages | | t_hdr_sdata_msg | ${MSGHDR}${MSGID} ${SDATA} ${MESSAGE} | Text-based representation of RFC5424-compliant syslog messages | | t_JSON_3164 | $(format-json --scope rfc3164
--pair PRI="<$PRI>"
--key LEGACY_MSGHDR
--exclude FACILITY
--exclude PRIORITY) | JSON output of all RFC3164-based syslog-ng macros. Useful with the "fallback" sourcetype to aid in new filter development. | -| t_JSON_5424 | $(format-json --scope rfc5424
--pair PRI="<$PRI>"
--exclude FACILITY
--exclude PRIORITY) | JSON output of all RFC5424-based syslog-ng macros; for use with RFC5424-compliant traffic. | +| t_JSON_5424 | $(format-json --scope rfc5424
--pair PRI="<$PRI>"
--key ISODATE
--exclude DATE
--exclude FACILITY
--exclude PRIORITY) | JSON output of all RFC5424-based syslog-ng macros; for use with RFC5424-compliant traffic. | ## Data Resilience - Local Disk Buffer Configuration