rsyslog for structured output

gistfile1.txt

module(load="imfile" mode="inotify")

input(type="imfile" 
      Tag="log" 
      File="/run/*.log" 
      Ruleset="applogs" 
      addMetadata="on")

template(name="jsonfmt" type="list") {
    property(name="timegenerated" dateformat="rfc3339")
    constant(value=" ")
    property(name="$!service")
    constant(value=" : ")
    property(name="msg")
    constant(value="\n")
}

ruleset(name="applogs") {
    set $!service=re_extract($!metadata!filename, "(.*)/([^/]*)", 0, 2, "unknown");
    action(type="ompipe" Pipe="/proc/1/fd/1" template="jsonfmt")
    stop
}