Message Fields
This page lists the built-in fields for format strings and filter expressions.
Parser fields (such as TIMESTAMP and HOSTNAME) come from the originator’s syslog parser.
Data Fields in a feature, view layout, parser, or report template add more fields from the message body.
Example
The originator 192.0.2.10, named Edge firewall, sends this RFC 5424 message:
<165>1 2026-10-13T16:42:17.123Z fw01.example.com sshd 2817 AUTH - Failed password for root from 203.0.113.45 port 51514 ssh2
Syslog storage receives it at 09:42:17.250311 server time (UTC-7). With the Standard IETF/BSD format parser, the fields are:
| Field | Value |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
RECEIVED
The time syslog storage received the message, in the server time zone.
It does not depend on the originator’s clock.
For UTC, use RECEIVED_UTC.
Without a date/time modifier, the value is an RFC 3339 timestamp, as in the examples below.
It is also a valid RFC 5424 syslog TIMESTAMP, so it can be used as is when building a syslog message.
Syslog Watcher 6 printed the server time zone offset without a colon (-0700); version 7 prints -07:00.
If a database, script, or other receiver parses {RECEIVED}, {RECEIVED_S}, or {RECEIVED_MS} without a date/time modifier, check that it accepts the new form.
For the old form, use {RECEIVED|%FT%T%z}.
|
| Field | Description | Example |
|---|---|---|
|
Microseconds, server time zone. |
|
|
Microseconds, UTC. |
|
|
Rounded to seconds, server time zone. |
|
|
Rounded to milliseconds, server time zone. |
|
|
Rounded to seconds, UTC. |
|
|
Rounded to milliseconds, UTC. |
|
ORIGINATOR
| Field | Description |
|---|---|
|
Originator ID; in simple cases, the IP address of the sender. |
|
Originator name. |
SEVERITY
| Field | Description |
|---|---|
|
Severity name (for example |
|
Severity as a number ( |
FACILITY
| Field | Description |
|---|---|
|
Facility name (for example |
|
Facility as a number ( |
PRIORITY
The syslog priority number: FACILITY_NUM * 8 + SEVERITY_NUM.
Use it to build the <PRI> prefix when forwarding.
RAW_MESSAGE
The message as received, without the <PRI> priority prefix.
To forward a syslog message in the same form as it arrived, use <{PRIORITY}>{RAW_MESSAGE}.
|
Parser Fields
The originator’s syslog parser fills these fields from the message header. A field is empty when the message has no such part or the parser does not read it.
| Field | Description |
|---|---|
|
Timestamp from the syslog header (not |
|
Hostname from the syslog header. |
|
Application name (RFC 5424) or tag (RFC 3164), when present. |
|
Process ID from the header, when present. |
|
Message ID from the header, when present. |
Parser sections can add more fields, for example CEF keys, name=value pairs, CSV values 001, 002, …, or RFC 5424 structured data as SDID:param.
See Message Sections.
All Extracted Fields
{*|…} repeats a template once per extracted field (sorted by name).
Inside that template, FIELD_NAME and FIELD_VALUE refer to the current field.
Example:
{*|{FIELD_NAME}={FIELD_VALUE}; }
A prefix before * limits the list to fields whose names start with it, for example the fields of one field collection:
{pa.*|{FIELD_NAME}={FIELD_VALUE}; }
JSON
To print the fields as a JSON object, begin with a fixed member, then put the comma before each repeated member.
This avoids a trailing comma.
{{ and }} print the object’s braces, and EscJSON makes names and values safe inside JSON strings:
{{"RECEIVED":"{RECEIVED_UTC}"{*|,"{FIELD_NAME|EscJSON}":"{FIELD_VALUE|EscJSON}"},"MESSAGE":"{MESSAGE|EscJSON}"}}
For the example message this prints:
{"RECEIVED":"2026-10-13T16:42:17.250311Z","APPNAME":"sshd","HOSTNAME":"fw01.example.com","MSGID":"AUTH","PROCID":"2817","TIMESTAMP":"2026-10-13T16:42:17.123Z","MESSAGE":"Failed password for root from 203.0.113.45 port 51514 ssh2"}
All values are JSON strings.
Related Topics
-
Field Extraction — extra fields from the message body