From e57f21169c654039d15fa54145e3a2216ca781e9 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Fri, 29 May 2020 15:18:48 -0400
Subject: [PATCH] Update templates.conf

---
 package/etc/conf.d/conflib/_common/templates.conf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf
index 7e1f665..f1bbb05 100644
--- a/package/etc/conf.d/conflib/_common/templates.conf
+++ b/package/etc/conf.d/conflib/_common/templates.conf
@@ -90,11 +90,12 @@ template t_JSON_3164 {
 
 template t_JSON_5424 {
     template('$(format-json --scope rfc5424
-                --key RAWMSG
+                --key MESSAGE
                 --exclude DATE
                 --exclude FACILITY
                 --exclude PRIORITY
                 --exclude HOST
+                --exclude RAWMSG                
                 )');
     };
 
@@ -109,6 +110,7 @@ template t_JSON_5424_SDATA {
                 --exclude HOST
                 --exclude FACILITY
                 --exclude PRIORITY
+                --exclude RAWMSG
                 )');
     };