Use this documentation with care! It describes the outdated version 7, which was actively developed around 2014 and is considered dead by the rsyslog team.

This documentation reflects the latest update of the v7-stable branch. It describes the 7.6.8 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v7 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is only limited rsyslog community support available for the outdated v7 version (officially we do not support it at all, but we usually are able to answer simple questions). If you need to stick with v7, it probably is best to ask your distribution for support.


Log Message Normalization Module

Module Name:    mmjsonparse

Available since:6.6.0+

Author:Rainer Gerhards <>


This module provides support for parsing structured log messages that follow the CEE/lumberjack spec. The so-called “CEE cookie” is checked and, if present, the JSON-encoded structured message content is parsed. The properties are than available as original message properties.

The “CEE cookie” is the character squence “@cee:” which must prepend the actual JSON. Note that the JSON must be valid and MUST NOT be followed by any non-JSON message. If either of these conditions is not true, mmjsonparse will not parse the associated JSON. This is based on the cookie definition used in CEE/project lumberjack and is meant to aid against an errornous detection of a message as being CEE where it is not.

This also means that mmjsonparse currently is NOT a generic JSON parser that picks up JSON from whereever it may occur in the message. This is intentional, but future versions may support config parameters to relax the format requirements.

Action specific Configuration Directives:

currently none


This activates the module and applies normalization to all messages:

module(load=”mmjsonparse”) action(type=”mmjsonparse”)

The same in legacy format:

$ModLoad mmjsonparse *.* :mmjsonparse:

[rsyslog.conf overview] [manual index] [rsyslog site]

This documentation is part of the rsyslog project. Copyright © 2012 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.

Previous topic

Fields Extraction Module (mmfields)

Next topic

Log Message Normalization Module

This Page