mode

Specifies the parsing mode for JSON content detection.

This parameter applies to JSON Structured Content Extraction Module (mmjsonparse).

Name:

mode

Scope:

action

Type:

string

Default:

cookie

Required?:

no

Introduced:

8.2506.0

Description

Sets the parsing mode to determine how JSON content is detected and processed.

• cookie (default): Legacy CEE cookie mode. Expects messages to begin with the configured cookie (default “@cee:”) followed by JSON content. This preserves backward compatibility with existing configurations.

• find-json: Scans the message to locate the first valid top-level JSON object “{…}” regardless of its position. The module uses a tokenizer-aware scanner that respects quotes and escapes to find complete JSON objects.

Input usage

# Legacy CEE cookie mode (default)
action(type="mmjsonparse" mode="cookie")

# Find-JSON scanning mode
action(type="mmjsonparse" mode="find-json")

See also

See also the main mmjsonparse module documentation.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.