From d30f7dd49b7c23f3753be73ac81adc7c40d4c8e2 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Fri, 29 May 2020 15:02:32 -0400
Subject: [PATCH] Simplify RFC5424 JSON

---
 package/etc/conf.d/conflib/_common/templates.conf | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf
index f9afd04..7e1f665 100644
--- a/package/etc/conf.d/conflib/_common/templates.conf
+++ b/package/etc/conf.d/conflib/_common/templates.conf
@@ -90,8 +90,6 @@ template t_JSON_3164 {
 
 template t_JSON_5424 {
     template('$(format-json --scope rfc5424
-                --pair PRI="<$PRI>"
-                --key ISODATE
                 --key RAWMSG
                 --exclude DATE
                 --exclude FACILITY
@@ -106,14 +104,11 @@ template t_JSON_5424 {
 
 template t_JSON_5424_SDATA {
     template('$(format-json --scope rfc5424
-                --pair PRI="<$PRI>"
-                --key ISODATE
-                --key RAWMSG
+                --key MESSAGE
                 --exclude DATE
                 --exclude HOST
                 --exclude FACILITY
                 --exclude PRIORITY
-                --exclude MESSAGE
                 )');
     };