Message Fields

A format string can include any number of fields {...}. A field name can be followed by one or more modifiers separated by vertical pipes (|).

Data Fields on a feature (or similar object) adds extra names from the message body. Parser-defined names (such as TIMESTAMP and HOSTNAME) come from the syslog parser for that originator.

RECEIVED

Time the message was received by syslog storage. Date parts use the storage time zone, not UTC and not the originator’s clock. Use RECEIVED_UTC when the value must follow UTC.

Without a date/time modifier, the default layout is ISO-8601 (2023-04-01T09:20:01.000000-0700 in the storage time zone, or …Z for UTC).

Field Description

RECEIVED

Microseconds, storage time zone.

RECEIVED_UTC

Microseconds, UTC.

RECEIVED_S

Rounded to seconds, storage time zone.

RECEIVED_MS

Rounded to milliseconds, storage time zone.

RECEIVED_UTC_S

Rounded to seconds, UTC.

RECEIVED_UTC_MS

Rounded to milliseconds, UTC.

Suffix order is _UTC, then _S or _MS.

ORIGINATOR

Field Description

ORIGINATOR_ID

Originator identification (ID).

Example: 123

ORIGINATOR_NAME

Originator name.

SEVERITY

Field Description

SEVERITY

Severity in text form (for example Emergency).

SEVERITY_NUM

Severity as a number (0–7).

FACILITY

Field Description

FACILITY

Facility in text form (for example Kernel).

FACILITY_NUM

Facility as a number (0–23).

PRIORITY

FACILITY_NUM * 8 + SEVERITY_NUM. Used when forming a syslog priority prefix for forwarding.

RAW_MESSAGE

The message as received, except the priority prefix.

To forward a syslog message in the same form as it arrived, use <{PRIORITY}>{RAW_MESSAGE}.

MESSAGE

The message body after the parser has taken headers off.

PARSER

Name of the syslog parser used for the message.

Parser fields

These names are filled by the originator’s syslog parser when the message has the corresponding parts. They can be blank for some parsers or message formats.

Field Description

TIMESTAMP

Timestamp from the syslog header (not RECEIVED).

HOSTNAME

Hostname from the syslog header.

APPNAME

Application name (RFC 5424) or tag (RFC 3164), when present.

PROCID

Process ID from the header, when present.

MSGID

Message ID from the header, when present.

All extracted fields

{*|…} repeats a template once per extracted field (sorted by name). Inside that template, FIELD_NAME and FIELD_VALUE refer to the current field.

Example:

{*|{FIELD_NAME}={FIELD_VALUE}; }

Related Topics