# https://github.com/tstack/lnav/blob/master/src/formats/syslog_log.json
Jun 27 01:47:20 bench-mac.local configd[17]: network changed: v4(en0-:192.168.1.8) DNS- Proxy- SMB ⇒ {"rule": "syslog", "level": "info", "name": "configd", "message": "network changed: v4(en0-:192.168.1.8) DNS- Proxy- SMB", "values": [], "prefixed": true, "device_ns": null}
2025-08-31T09:36:55.418891-07:00 stack-pc2 rsyslogd: [origin software="rsyslogd" swVersion="8.2312.0" x-pid="1186" x-info="https://www.rsyslog.com"] rsyslogd was HUPed ⇒ {"rule": "syslog", "level": "info", "name": "rsyslogd", "message": "[origin software=\"rsyslogd\" swVersion=\"8.2312.0\" x-pid=\"1186\" x-info=\"https://www.rsyslog.com\"] rsyslogd was HUPed", "values": [], "prefixed": true, "device_ns": null}
<46>1 2017-04-27T07:50:47.381967+02:00 logserver rsyslogd - - [origin software="rsyslogd" swVersion="8.4.2" x-pid="900" x-info="http://www.rsyslog.com"] start ⇒ {"rule": "syslog", "level": "info", "name": "rsyslogd", "message": "start", "values": [], "prefixed": true, "device_ns": null}
# https://www.rfc-editor.org/rfc/rfc5424#section-6.5 and https://www.rfc-editor.org/rfc/rfc3164#section-5.4
# constructed <34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - BOM'su root' failed for lonvick on /dev/pts/8 ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "BOM'su root' failed for lonvick on /dev/pts/8", "values": [], "prefixed": true, "device_ns": null}
<165>1 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - %% It's time to make the do-nuts. ⇒ {"rule": "syslog", "level": "info", "name": "myproc", "message": "%% It's time to make the do-nuts.", "values": [], "prefixed": true, "device_ns": null}
# constructed <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] An application event log entry... ⇒ {"rule": "syslog", "level": "info", "name": "evntslog", "message": "An application event log entry...", "values": [], "prefixed": true, "device_ns": null}
<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8 ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "'su root' failed for lonvick on /dev/pts/8", "values": [], "prefixed": true, "device_ns": null}
# captures from the journalctl fixtures: sshd lines
# constructed Oct 21 14:12:01 bench-1 sshd[812]: Server listening on 0.0.0.0 port 22. ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "Server listening on 0.0.0.0 port 22.", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 sshd[812]: Received disconnect from 172.18.0.11 port 54926:11: disconnected by user ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "Received disconnect from 172.18.0.11 port 54926:11: disconnected by user", "values": [], "prefixed": true, "device_ns": null}
# BusyBox syslogd captures, with and without -S
Oct 21 18:19:49 b-alp-C user.warn root: warn line one ⇒ {"rule": "syslog", "level": "warn", "name": "root", "message": "warn line one", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:49 b-alp-C daemon.err root: err line two ⇒ {"rule": "syslog", "level": "error", "name": "root", "message": "err line two", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:49 b-alp-C user.info mytag: info with tag ⇒ {"rule": "syslog", "level": "info", "name": "mytag", "message": "info with tag", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:49 b-alp-C auth.crit svc: multi word  message, with: colons ⇒ {"rule": "syslog", "level": "critical", "name": "svc", "message": "multi word  message, with: colons", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:49 b-alp-C user.debug root: debug line ⇒ {"rule": "syslog", "level": "debug", "name": "root", "message": "debug line", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:49 b-alp-C user.notice root: notice ⇒ {"rule": "syslog", "level": "info", "name": "root", "message": "notice", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:49 b-alp-C kern.emerg root: emerg ⇒ {"rule": "syslog", "level": "critical", "name": "root", "message": "emerg", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:52 root: warn line one ⇒ {"rule": "syslog", "level": "info", "name": "root", "message": "warn line one", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:52 mytag: info with tag ⇒ {"rule": "syslog", "level": "info", "name": "mytag", "message": "info with tag", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:19:52 svc: multi word  message, with: colons ⇒ {"rule": "syslog", "level": "info", "name": "svc", "message": "multi word  message, with: colons", "values": [], "prefixed": true, "device_ns": null}
Oct 21 18:09:50 b-alp-C syslog.info syslogd started: BusyBox v1.36.1 ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "syslogd started: BusyBox v1.36.1", "values": [], "prefixed": true, "device_ns": null}
# journalctl -o short, short-precise and short-iso
# constructed Oct 21 14:12:01 bench-1 pump[123]: started ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "started", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct  1 04:02:03 bench-1 pump[123]: single digit day is space padded ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "single digit day is space padded", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01.123456 bench-1 pump[123]: short-precise ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "short-precise", "values": [], "prefixed": true, "device_ns": null}
# constructed 2026-10-21T14:12:01+0000 bench-1 pump[123]: short-iso ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "short-iso", "values": [], "prefixed": true, "device_ns": null}
# constructed 2026-10-21T14:12:01.123456+0000 bench-1 pump[123]: short-iso-precise ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "short-iso-precise", "values": [], "prefixed": true, "device_ns": null}
# constructed 2026-10-21T14:12:01.123456+02:00 bench-1 pump: offset with a colon and no pid ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "offset with a colon and no pid", "values": [], "prefixed": true, "device_ns": null}
# constructed 2026-10-21T14:12:01Z bench-1 pump[123]: zulu stamp ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "zulu stamp", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 systemd-logind[321]: dashed program ⇒ {"rule": "syslog", "level": "info", "name": "systemd-logind", "message": "dashed program", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 (modprobe)[210]: program in parentheses ⇒ {"rule": "syslog", "level": "info", "name": "(modprobe)", "message": "program in parentheses", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 com.acme.pump: dotted program without a pid ⇒ {"rule": "syslog", "level": "info", "name": "com.acme.pump", "message": "dotted program without a pid", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 kernel: usb 1-1: new high-speed USB device number 2 using xhci_hcd ⇒ {"rule": "syslog", "level": "info", "name": "kernel", "message": "usb 1-1: new high-speed USB device number 2 using xhci_hcd", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 pump[123]:  ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 pump[123]: rail=13.65V temp=24.5C ⇒ {"rule": "syslog+kv", "level": "info", "name": "pump", "message": "rail=13.65V temp=24.5C", "values": [["rail", 13.65, "V"], ["temp", 24.5, "C"]], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 pump[123]: disk error on /dev/sda is only a word ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "disk error on /dev/sda is only a word", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 pump[123]: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "values": [], "prefixed": true, "device_ns": null}
# a carried line with its own header: its level wins
# constructed Oct 21 14:12:01 bench-1 pump[123]: ERROR: motor stalled ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "motor stalled", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 pump[123]: [WRN] low battery ⇒ {"rule": "syslog", "level": "warn", "name": "pump", "message": "low battery", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 app[1]: ERROR:db:connect failed ⇒ {"rule": "syslog", "level": "error", "name": "app", "message": "connect failed", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 14:12:01 bench-1 app[1]: [00:00:01.000,000] <inf> main: ready ⇒ {"rule": "syslog", "level": "info", "name": "app", "values": [], "prefixed": true, "device_ns": 1000000000, "message": "main: ready"}
# constructed Oct 21 18:19:49 b-alp-C user.warn pump[1]: INFO: recovered ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "recovered", "values": [], "prefixed": true, "device_ns": null}
# constructed Oct 21 18:19:49 b-alp-C daemon.err pump[1]: plain text under err ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "plain text under err", "values": [], "prefixed": true, "device_ns": null}
# a carried kernel line keeps its device uptime; the record's severity is its level
# constructed Oct 21 14:12:01 bench-1 kernel: [    1.234567] usb 1-1: new device ⇒ {"rule": "syslog", "level": "info", "name": "kernel", "message": "usb 1-1: new device", "values": [], "prefixed": true, "device_ns": 1234567000}
# constructed Oct 21 18:19:49 b-alp-C kern.warn kernel: [    1.234567] thermal: trip point reached ⇒ {"rule": "syslog", "level": "warn", "name": "kernel", "message": "thermal: trip point reached", "values": [], "prefixed": true, "device_ns": 1234567000}
# OpenWrt logread
# constructed Thu Oct 21 14:12:01 2026 daemon.warn pump[123]: low pressure ⇒ {"rule": "syslog", "level": "warn", "name": "pump", "message": "low pressure", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 daemon.notice netifd: Interface 'lan' is now up ⇒ {"rule": "syslog", "level": "info", "name": "netifd", "message": "Interface 'lan' is now up", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct  1 14:12:01 2026 daemon.err uhttpd[1456]: single digit day ⇒ {"rule": "syslog", "level": "error", "name": "uhttpd", "message": "single digit day", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 user.info root: info ⇒ {"rule": "syslog", "level": "info", "name": "root", "message": "info", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 daemon.info dnsmasq-dhcp[1234]: DHCPACK(br-lan) 192.168.1.50 aa:bb:cc:dd:ee:ff laptop ⇒ {"rule": "syslog", "level": "info", "name": "dnsmasq-dhcp", "message": "DHCPACK(br-lan) 192.168.1.50 aa:bb:cc:dd:ee:ff laptop", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 daemon.debug pump[1]: debug ⇒ {"rule": "syslog", "level": "debug", "name": "pump", "message": "debug", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 daemon.crit pump[1]: crit ⇒ {"rule": "syslog", "level": "critical", "name": "pump", "message": "crit", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 kern.warn kernel: [   12.345678] thermal: trip point reached ⇒ {"rule": "syslog", "level": "warn", "name": "kernel", "message": "thermal: trip point reached", "values": [], "prefixed": true, "device_ns": 12345678000}
# constructed Thu Oct 21 14:12:01 2026 kern.info kernel: [    5.678901] usb 1-1: new device ⇒ {"rule": "syslog", "level": "info", "name": "kernel", "message": "usb 1-1: new device", "values": [], "prefixed": true, "device_ns": 5678901000}
# constructed Thu Oct 21 14:12:01 2026 daemon.warn pump[1]: ERROR: header beats the facility ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "header beats the facility", "values": [], "prefixed": true, "device_ns": null}
# constructed Thu Oct 21 14:12:01 2026 user.notice a message from no program ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "a message from no program"}
# syslog on the wire, RFC 3164
# constructed <12>Oct 21 14:12:01 bench-1 pump[123]: low pressure ⇒ {"rule": "syslog", "level": "warn", "name": "pump", "message": "low pressure", "values": [], "prefixed": true, "device_ns": null}
# constructed <14>Oct 21 14:12:01 bench-1 pump[123]: started ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "started", "values": [], "prefixed": true, "device_ns": null}
# constructed <11>Oct 21 14:12:01 bench-1 pump[123]: disk write failed ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "disk write failed", "values": [], "prefixed": true, "device_ns": null}
# constructed <14>Oct 21 14:12:01 bench-1 pump[1]: ERROR: header beats the priority ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "header beats the priority", "values": [], "prefixed": true, "device_ns": null}
# constructed <11>Oct 21 14:12:01 bench-1 pump[1]: INFO: header beats the priority ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "header beats the priority", "values": [], "prefixed": true, "device_ns": null}
# constructed <14>Oct 21 14:12:01 bench-1 app[1]: [WRN] header beats the priority ⇒ {"rule": "syslog", "level": "warn", "name": "app", "message": "header beats the priority", "values": [], "prefixed": true, "device_ns": null}
# constructed <12>Oct 21 14:12:01 bench-1 kernel: [    1.234567] thermal: trip point reached ⇒ {"rule": "syslog", "level": "warn", "name": "kernel", "message": "thermal: trip point reached", "values": [], "prefixed": true, "device_ns": 1234567000}
# constructed <191>Oct 21 14:12:01 bench-1 pump[1]: highest valid priority ⇒ {"rule": "syslog", "level": "debug", "name": "pump", "message": "highest valid priority", "values": [], "prefixed": true, "device_ns": null}
# syslog on the wire, RFC 5424
# constructed <165>1 2003-10-11T22:14:15.003Z mymachine.example.com - - ID47 - no app name ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "no app name"}
# the message starts with a byte-order mark
# constructed <34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - ﻿'su root' failed for lonvick on /dev/pts/8 ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "'su root' failed for lonvick on /dev/pts/8"}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 [meta@1 path="a\]b" q="say \"hi\"" s="back\\slash"] message after escapes ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "message after escapes"}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 [meta@1 path="a]b"] an unescaped bracket inside quotes ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "an unescaped bracket inside quotes"}
# constructed <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"] ⇒ {"rule": "syslog", "level": "info", "name": "evntslog", "message": ""}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 - started ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "started", "values": [], "prefixed": true, "device_ns": null}
# constructed <163>1 2026-10-21T14:12:01.123456+02:00 bench-1 pump 123 ID47 - disk write failed ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "disk write failed", "values": [], "prefixed": true, "device_ns": null}
# constructed <164>1 2026-10-21T14:12:01Z bench-1 pump - - - nil fields ⇒ {"rule": "syslog", "level": "warn", "name": "pump", "message": "nil fields", "values": [], "prefixed": true, "device_ns": null}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 [meta@1 a="1"][other@2 b="2"] two structured data elements ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "two structured data elements", "values": [], "prefixed": true, "device_ns": null}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 [meta@1 a="1"]  ⇒ {"rule": "syslog", "level": "info", "name": "pump", "message": "", "values": [], "prefixed": true, "device_ns": null}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 - rail=13.65V temp=24.5C ⇒ {"rule": "syslog+kv", "level": "info", "name": "pump", "message": "rail=13.65V temp=24.5C", "values": [["rail", 13.65, "V"], ["temp", 24.5, "C"]], "prefixed": true, "device_ns": null}
# constructed <165>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 - ERROR: header beats the priority ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "header beats the priority", "values": [], "prefixed": true, "device_ns": null}
# constructed <167>1 2026-10-21T14:12:01Z bench-1 pump 123 ID47 - debug severity ⇒ {"rule": "syslog", "level": "debug", "name": "pump", "message": "debug severity", "values": [], "prefixed": true, "device_ns": null}
# systemd level prefix, only 0 to 7
# constructed <0>pump says level 0 ⇒ {"rule": "syslog", "level": "critical", "name": "", "message": "pump says level 0", "values": [], "prefixed": true, "device_ns": null}
# constructed <1>pump says level 1 ⇒ {"rule": "syslog", "level": "critical", "name": "", "message": "pump says level 1", "values": [], "prefixed": true, "device_ns": null}
# constructed <2>pump says level 2 ⇒ {"rule": "syslog", "level": "critical", "name": "", "message": "pump says level 2", "values": [], "prefixed": true, "device_ns": null}
# constructed <3>pump says level 3 ⇒ {"rule": "syslog", "level": "error", "name": "", "message": "pump says level 3", "values": [], "prefixed": true, "device_ns": null}
# constructed <4>pump says level 4 ⇒ {"rule": "syslog", "level": "warn", "name": "", "message": "pump says level 4", "values": [], "prefixed": true, "device_ns": null}
# constructed <5>pump says level 5 ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "pump says level 5", "values": [], "prefixed": true, "device_ns": null}
# constructed <6>pump says level 6 ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "pump says level 6", "values": [], "prefixed": true, "device_ns": null}
# constructed <7>pump says level 7 ⇒ {"rule": "syslog", "level": "debug", "name": "", "message": "pump says level 7", "values": [], "prefixed": true, "device_ns": null}
# constructed <4>disk almost full ⇒ {"rule": "syslog", "level": "warn", "name": "", "message": "disk almost full", "values": [], "prefixed": true, "device_ns": null}
# constructed <6> ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "", "values": [], "prefixed": true, "device_ns": null}
# constructed <4>rail=13.65V temp=24.5C ⇒ {"rule": "syslog+kv", "level": "warn", "name": "", "message": "rail=13.65V temp=24.5C", "values": [["rail", 13.65, "V"], ["temp", 24.5, "C"]], "prefixed": true, "device_ns": null}
# constructed <6>ERROR: header beats the priority ⇒ {"rule": "syslog", "level": "error", "name": "", "message": "header beats the priority", "values": [], "prefixed": true, "device_ns": null}
# constructed <3>INFO: header beats the priority ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "header beats the priority", "values": [], "prefixed": true, "device_ns": null}
# constructed <4>[00:00:01.000,000] <inf> main: header beats the priority ⇒ {"rule": "syslog", "level": "info", "name": "main", "values": [], "prefixed": true, "device_ns": 1000000000, "message": "main: header beats the priority"}
# constructed <6>[    1.234567] usb 1-1: new device ⇒ {"rule": "syslog", "level": "info", "name": "kernel", "message": "usb 1-1: new device", "values": [], "prefixed": true, "device_ns": 1234567000}
# constructed <4>[    1.234567] thermal: trip point reached ⇒ {"rule": "syslog", "level": "warn", "name": "kernel", "message": "thermal: trip point reached", "values": [], "prefixed": true, "device_ns": 1234567000}
# journalctl -o short-full and with-unit, short-unix, short-monotonic and short-delta: systemd v257.4 src/shared/logs-show.c output_short, output_timestamp_realtime ("%10llu.%06llu" for unix, format_timestamp_style for full), output_timestamp_monotonic ("[%5llu.%06llu", " <%5llu.%06llu%s>" or "%16s" for delta, "]")
# constructed Tue 2012-07-17 16:01:01 UTC host sshd[587]: Server listening on 0.0.0.0 port 22. ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "sshd", "message": "Server listening on 0.0.0.0 port 22.", "device_ns": null}
# constructed Tue 2012-07-17 18:01:01 CEST host sshd[587]: zone named by the system ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "zone named by the system"}
# constructed Tue 2012-07-17 16:01:01 UTC host ssh.service[587]: with-unit prints the unit ⇒ {"rule": "syslog", "level": "info", "name": "ssh.service", "message": "with-unit prints the unit"}
# constructed Tue 2012-07-17 16:01:01 UTC host user@1000.service/app.service[587]: a user unit follows the unit ⇒ {"rule": "syslog", "level": "info", "name": "user@1000.service/app.service", "message": "a user unit follows the unit"}
# constructed Tue 2012-07-17 16:01:01 UTC sshd[587]: no hostname ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "no hostname"}
# constructed 1342540861.416409 host sshd[587]: Server listening on 0.0.0.0 port 22. ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "Server listening on 0.0.0.0 port 22.", "device_ns": null}
# constructed [21415.215982] host sshd[587]: Server listening on 0.0.0.0 port 22. ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "sshd", "message": "Server listening on 0.0.0.0 port 22.", "device_ns": 21415215982000}
# constructed [21415.215982 <    0.000000 >] host sshd[587]: Server listening on 0.0.0.0 port 22. ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "device_ns": 21415215982000, "message": "Server listening on 0.0.0.0 port 22."}
# constructed [21415.221038 <    0.005056*>] host sshd[587]: unreliable delta ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "unreliable delta", "device_ns": 21415221038000}
# constructed [   12.000001                ] host sshd[587]: no delta available ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "no delta available", "device_ns": 12000001000}
# constructed [    1.234567] bench-1 kernel: usb 1-1: new device ⇒ {"rule": "syslog", "level": "info", "name": "kernel", "message": "usb 1-1: new device", "device_ns": 1234567000}
# constructed [    5.000000] bench-1 pump[123]: ERROR: motor stalled ⇒ {"rule": "syslog", "level": "error", "name": "pump", "message": "motor stalled", "device_ns": 5000000000}
# an identifier is printed as the journal holds it, a ] included
# constructed Jul 17 16:01:01 host gdm-password][587]: AccountsService-DEBUG(+): ActUserManager: ignoring unspecified session '8' since it's not graphical: Success ⇒ {"rule": "syslog", "level": "info", "name": "gdm-password]", "message": "AccountsService-DEBUG(+): ActUserManager: ignoring unspecified session '8' since it's not graphical: Success"}
# a kernel line's message often looks like "subsystem device: text"; only a host then an identifier with its pid, or "kernel", is a journal line
# constructed [    2.000000] systemd[1]: Started Journal Service. ⇒ {"rule": "linux", "level": "info", "name": "kernel", "device_ns": 2000000000, "message": "systemd[1]: Started Journal Service."}
# constructed [  123.456789] python3[1234]: segfault at 0 ip 00007f1c sp 00007ffd error 4 in libc.so.6 ⇒ {"rule": "linux", "level": "info", "name": "kernel", "message": "python3[1234]: segfault at 0 ip 00007f1c sp 00007ffd error 4 in libc.so.6"}
# constructed [    0.232253] 38000000.serial: ttySIF0 at MMIO 0x38000000 (irq = 1, base_baud = 115200) is a SiFive UART v0 ⇒ {"rule": "linux", "level": "info", "name": "kernel", "message": "38000000.serial: ttySIF0 at MMIO 0x38000000 (irq = 1, base_baud = 115200) is a SiFive UART v0"}
# constructed [    1.234567] usb 1-1: new high-speed USB device number 2 using xhci_hcd ⇒ {"rule": "linux", "level": "info", "name": "kernel", "message": "usb 1-1: new high-speed USB device number 2 using xhci_hcd"}
# syslog-ng 4.12.0 lib/logwriter.c "<stamp> HOST <PROGRAM[PID]: >MESSAGE", lib/timeutils/format.c ts_format full ("YYYY Mmm dd hh:mm:ss") and unix (seconds); with no program the message follows the host
# constructed 2026 Mar  4 12:00:00 host sshd[812]: ts_format(full) ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "ts_format(full)"}
# constructed 1772625600 host sshd[812]: ts_format(unix) ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "ts_format(unix)"}
# constructed 1772625600.123 host sshd[812]: ts_format(unix) frac-digits(3) ⇒ {"rule": "syslog", "level": "info", "name": "sshd", "message": "ts_format(unix) frac-digits(3)"}
# constructed Mar  4 12:00:00 host msg without program ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "", "message": "msg without program"}
# constructed Oct 21 14:12:01 bench-1 pump msg without a colon ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "pump msg without a colon"}
# constructed Oct 21 14:12:01 bench-1 pump[abc]: pid is not a number ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "pump[abc]: pid is not a number"}
# constructed Oct 21 14:12:01 bench-1 pump:no space after the colon ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "pump:no space after the colon"}
# constructed Oct 21 14:12:01 bench-1 user.bogus pump: unknown severity ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "user.bogus pump: unknown severity"}
# constructed Oct 21 14:12:01 bench-1 level=warn msg="disk low" ⇒ {"rule": "syslog", "level": "warn", "name": "", "message": "disk low"}
# BusyBox 1_36_1 syslogd.c timestamp_and_log_internal: syslogd's own lines carry no tag, and -S prints no host
# constructed Oct 21 18:19:49 syslogd started: BusyBox v1.36.1 ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "", "message": "syslogd started: BusyBox v1.36.1"}
# constructed Oct 21 18:19:49 syslogd exiting ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "syslogd exiting"}
# constructed Oct 21 18:19:49.123 -- MARK -- ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "-- MARK --"}
# RFC 3164 section 5.4: a priority and no tag, and a relay's header in front of a record it could not read
<13>Feb  5 17:32:18 10.0.0.99 Use the BFG! ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "", "message": "Use the BFG!"}
# constructed <0>Oct 22 10:52:12 scapegoat 1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3 sched[0]: That's All Folks! ⇒ {"rule": "syslog", "level": "critical", "name": "", "message": "1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3 sched[0]: That's All Folks!"}
# constructed <0>1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3 sched[0]: That's All Folks! ⇒ {"rule": "syslog", "level": "critical", "name": "", "message": "1990 Oct 22 10:52:01 TZ-6 scapegoat.dmz.example.org 10.1.2.3 sched[0]: That's All Folks!"}
# constructed <165>Aug 24 05:34:00 CST 1987 mymachine myproc[10]: %% It's time to make the do-nuts. ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "", "message": "1987 mymachine myproc[10]: %% It's time to make the do-nuts."}
# RFC 6587 section 3.4.1 octet counting: MSG-LEN SP SYSLOG-MSG, one frame per line
# constructed 99 <165>1 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - %% It's time to make the do-nuts. ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "myproc", "message": "%% It's time to make the do-nuts."}
# constructed 107 <34>1 2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 - 'su root' failed for lonvick on /dev/pts/8 ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "'su root' failed for lonvick on /dev/pts/8"}
# constructed 76 <34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8 ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "'su root' failed for lonvick on /dev/pts/8"}
# constructed 172 <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] An application event log entry... ⇒ {"rule": "syslog", "level": "info", "name": "evntslog", "message": "An application event log entry..."}
# macOS log show and log stream, captured on macOS (Darwin 27.0.0); the default style prints the type, compact its code, syslog style none
2026-10-21 17:17:58.228367-0700 0xce8      Default     0x0                  0      0    kernel: (com.apple.DriverKit-AppleBCMWLAN.dext) Update txBytesValid No or rxBytesValid No ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "kernel", "message": "(com.apple.DriverKit-AppleBCMWLAN.dext) Update txBytesValid No or rxBytesValid No", "device_ns": null}
2026-10-21 17:18:00.016952-0700 0x61259e   Debug       0x0                  0      0    kernel: (AppleSystemPolicy) Thread waiting on reference 11530 woke up ⇒ {"rule": "syslog", "level": "debug", "name": "kernel", "message": "(AppleSystemPolicy) Thread waiting on reference 11530 woke up"}
2026-10-21 17:17:59.980674-0700 0x611881   Error       0x0                  283    0    syspolicyd: [com.apple.syspolicy:default] Unable to get certificates array: (null) ⇒ {"rule": "syslog", "level": "error", "name": "syspolicyd", "message": "[com.apple.syspolicy:default] Unable to get certificates array: (null)"}
2026-10-21 17:18:58.841371-0700 0x74a      Fault       0x99bd1d             158    14   apsd: Peer connection [pid=55893] lacks APSConnectionInitiateEntitlement ⇒ {"rule": "syslog+kv", "level": "critical", "name": "apsd", "message": "Peer connection [pid=55893] lacks APSConnectionInitiateEntitlement"}
2026-10-21 17:17:58.871052-0700 0x612548   Info        0x99bf70             431    0    trustd: (SwiftCRLite) [ValidDaemon:metric] crliteEval: skipped=<private> <private> ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "trustd", "message": "(SwiftCRLite) [ValidDaemon:metric] crliteEval: skipped=<private> <private>"}
2026-10-21 17:20:56.095208-0700 0x0        State       0x99ed94             194    14   runningboardd: (C5AFC4BD-0B42-3013-8D42-C0CA3F9A37DB) RBAssertionManager ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "runningboardd", "message": "(C5AFC4BD-0B42-3013-8D42-C0CA3F9A37DB) RBAssertionManager"}
# the log(1) man page's example, from before the TTL column
2016-06-13 11:46:37.248693-0700 0x7c393    Default     0x0          10371  timestamp: [com.example.subsystem.CHECKTIME] Time is 06/13/2016 11:46:37 ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "timestamp", "message": "[com.example.subsystem.CHECKTIME] Time is 06/13/2016 11:46:37"}
2026-10-21 17:17:57.116 Df locationd[164:60a59d] [com.apple.icloud.SPFinder:advertisementCache] saveBeaconPayload: 1 ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "locationd", "message": "[com.apple.icloud.SPFinder:advertisementCache] saveBeaconPayload: 1"}
2026-10-21 17:17:59.980 E  syspolicyd[283:611881] [com.apple.libsqlite3:logging-persist] cannot open file at line 53009 of [8fa8248e30] ⇒ {"rule": "syslog", "level": "error", "name": "syspolicyd", "message": "[com.apple.libsqlite3:logging-persist] cannot open file at line 53009 of [8fa8248e30]"}
2026-10-21 17:18:58.841 F  apsd[158:74a] Peer connection [pid=55893] lacks APSConnectionInitiateEntitlement ⇒ {"rule": "syslog+kv", "level": "critical", "name": "apsd", "message": "Peer connection [pid=55893] lacks APSConnectionInitiateEntitlement"}
2026-10-21 17:17:57.115 I  bluetoothd[181:b17] [com.apple.bluetooth:Stack.LE]  Invalid Dual mode support indication in AD flags 0x00000000. ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "bluetoothd", "message": "[com.apple.bluetooth:Stack.LE]  Invalid Dual mode support indication in AD flags 0x00000000."}
2026-10-21 17:18:00.016 Db kernel[0:61259e] (AppleSystemPolicy) Thread waiting on reference 11530 woke up ⇒ {"rule": "syslog", "level": "debug", "name": "kernel", "message": "(AppleSystemPolicy) Thread waiting on reference 11530 woke up"}
2026-10-21 17:17:57.116 A  locationd[164:60a59d] (SPFinder) SPAdvertisementCache saveBeaconPayloads:completion: ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "locationd", "message": "(SPFinder) SPAdvertisementCache saveBeaconPayloads:completion:"}
2026-10-21 17:22:23.130 I  Google Chrome[12141:6155ec] [com.apple.network:path] nw_path_necp_update_evaluator_block_invoke [0ECB7666-1F7A-4A42-AFE0-630630D3337E <NULL> generic, attribution: developer] ⇒ {"rule": "syslog", "level": "info", "name": "Google Chrome", "message": "[com.apple.network:path] nw_path_necp_update_evaluator_block_invoke [0ECB7666-1F7A-4A42-AFE0-630630D3337E <NULL> generic, attribution: developer]"}
2026-10-21 17:22:15.000559-0700  localhost kernel[0]: (com.apple.DriverKit-AppleBCMWLAN.dext) IO80211PeerMonitor::checkForDPS()  Enter ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "kernel", "message": "(com.apple.DriverKit-AppleBCMWLAN.dext) IO80211PeerMonitor::checkForDPS()  Enter"}
2026-10-21 17:22:13.124953-0700  localhost searchpartyd[332]: [com.apple.icloud.searchpartyd:advertisementCache] Ignoring advertisements while finder is off. ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "searchpartyd", "message": "[com.apple.icloud.searchpartyd:advertisementCache] Ignoring advertisements while finder is off."}
# constructed Foo 21 14:12:01 bench-1 pump: not a month ⇒ {"rule": "plain", "level": "info", "message": "Foo 21 14:12:01 bench-1 pump: not a month"}
# constructed Oct 21 14:12 bench-1 pump: no seconds ⇒ {"rule": "plain", "level": "info", "message": "Oct 21 14:12 bench-1 pump: no seconds"}
# constructed Oct 21 is the day the pump failed ⇒ {"rule": "plain", "level": "info", "message": "Oct 21 is the day the pump failed"}
# constructed Thu Oct 21 14:12:01 2026 pump[123]: no facility and level ⇒ {"rule": "plain", "level": "info", "message": "Thu Oct 21 14:12:01 2026 pump[123]: no facility and level"}
# constructed Thu Oct 21 14:12:01 2026 daemon.bogus pump: unknown severity ⇒ {"rule": "plain", "level": "info", "message": "Thu Oct 21 14:12:01 2026 daemon.bogus pump: unknown severity"}
# constructed <192>Oct 21 14:12:01 bench-1 pump: priority above 191 ⇒ {"rule": "plain", "level": "info", "message": "<192>Oct 21 14:12:01 bench-1 pump: priority above 191"}
# constructed <12>no syslog record behind a priority above 7 ⇒ {"rule": "plain", "level": "info", "message": "<12>no syslog record behind a priority above 7"}
# constructed <8>priority 8 is not a systemd level ⇒ {"rule": "plain", "level": "info", "message": "<8>priority 8 is not a systemd level"}
# constructed <-1>negative priority ⇒ {"rule": "plain", "level": "info", "message": "<-1>negative priority"}
# constructed <4 >space inside the priority ⇒ {"rule": "plain", "level": "info", "message": "<4 >space inside the priority"}
# constructed <>empty priority ⇒ {"rule": "plain", "level": "info", "message": "<>empty priority"}
# constructed <165>2 2026-10-21T14:12:01Z bench-1 pump 123 ID47 - version 2 ⇒ {"rule": "plain", "level": "info", "message": "<165>2 2026-10-21T14:12:01Z bench-1 pump 123 ID47 - version 2"}
# captured from hashicorp/go-hclog v1.6.3: a bracketed level is not a host
2026-10-21T17:15:46.011-0700 [TRACE] myapp.db: trace msg: k=1 ⇒ {"rule": "layout+kv", "level": "trace", "leveled": true, "name": "myapp.db", "message": "trace msg: k=1"}
2026-10-21T17:15:46.011-0700 [DEBUG] myapp.db: debug msg: k=1 ⇒ {"rule": "layout+kv", "level": "debug", "leveled": true, "name": "myapp.db", "message": "debug msg: k=1"}
# constructed 2026-10-21T14:12:01Z [worker] job: done ⇒ {"rule": "plain", "level": "info", "message": "2026-10-21T14:12:01Z [worker] job: done"}
# sysklogd logs its own restart with no tag, and a program name with a space is not one token
Apr 28 04:02:03 tstack-centos5 syslogd 1.4.1: restart. ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "", "message": "syslogd 1.4.1: restart."}
Jan  4 10:23:26 bench-mac Setup Assistant[1173]: Creating connection ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "", "message": "Setup Assistant[1173]: Creating connection"}
Jun 20 17:26:13 ip-10-188-149-5 [CLOUDINIT] util.py[DEBUG]: Restoring selinux mode for /var/lib/cloud (recursive=False) ⇒ {"rule": "syslog", "level": "info", "name": "", "message": "[CLOUDINIT] util.py[DEBUG]: Restoring selinux mode for /var/lib/cloud (recursive=False)"}
# syslog(3) with LOG_PERROR on macOS echoes "<stamp>  <ident>[<pid>] <Level>: ", captured on macOS (Darwin 27.0.0)
Oct 21 17:38:03  myprog[84347] <Debug>: debug msg ⇒ {"rule": "syslog-stderr", "level": "debug", "name": "myprog", "message": "debug msg"}
Oct 21 17:38:03  myprog[84347] <Notice>: notice msg ⇒ {"rule": "syslog-stderr", "level": "info", "leveled": true, "name": "myprog", "message": "notice msg"}
Oct 21 17:38:03  myprog[84347] <Warning>: warn msg ⇒ {"rule": "syslog-stderr", "level": "warn", "name": "myprog", "message": "warn msg"}
Oct 21 17:38:03  myprog[84347] <Error>: error msg: connection refused ⇒ {"rule": "syslog-stderr", "level": "error", "name": "myprog", "message": "error msg: connection refused"}
Oct 21 17:38:03  myprog[84347] <Emergency>: emerg msg ⇒ {"rule": "syslog-stderr", "level": "critical", "name": "myprog", "message": "emerg msg"}
# constructed Oct 21 17:38:03  myprog[84347] <Verbose>: not an ASL level ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "Oct 21 17:38:03  myprog[84347] <Verbose>: not an ASL level"}
# dmesg -r: util-linux v2.42.4 sys-utils/dmesg.c "<%d>[%5ld.%06ld] " with the record's facility and level
# constructed <30>[    2.000000] systemd[1]: Started Journal Service. ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "", "message": "systemd[1]: Started Journal Service.", "device_ns": 2000000000}
# constructed <12>[    5.000000] acme: user space warning ⇒ {"rule": "syslog", "level": "warn", "name": "", "message": "acme: user space warning"}
# macOS log styles need their exact columns
# constructed 2026-10-21 17:17:58.228367 0xce8      Default     0x0                  0      0    kernel: no zone ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21 17:17:58.228367 0xce8      Default     0x0                  0      0    kernel: no zone"}
# constructed 2026-10-21 17:17:57.116 Df locationd saveBeaconPayload: no pid and thread ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21 17:17:57.116 Df locationd saveBeaconPayload: no pid and thread"}
# constructed 2026-10-21 17:17:57.116 Df locationd[164] saveBeaconPayload: no thread ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "2026-10-21 17:17:57.116 Df locationd[164] saveBeaconPayload: no thread"}
# constructed ERROR: Oct 21 14:12:01 bench-1 pump: level word first ⇒ {"rule": "level-word", "level": "error", "message": "Oct 21 14:12:01 bench-1 pump: level word first"}
# constructed [    1.234567] usb 1-1: new device ⇒ {"rule": "linux", "level": "info", "name": "kernel", "message": "usb 1-1: new device"}
# constructed [00:00:01.000,000] <wrn> main: zephyr ⇒ {"rule": "zephyr", "level": "warn", "name": "main", "message": "main: zephyr"}
# RFC 6587 section 3.4.1: frames with no newline between them read as one record, so no frame
# is lost; splitting them is the receiving source's job
# constructed 76 <34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/876 <34>Oct 11 22:14:16 mymachine su: the next frame ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "'su root' failed for lonvick on /dev/pts/876 <34>Oct 11 22:14:16 mymachine su: the next frame"}
# constructed 200 <34>Oct 11 22:14:15 mymachine su: a frame shorter than its count ⇒ {"rule": "syslog", "level": "critical", "name": "su", "message": "a frame shorter than its count"}
# ESXi 8 /var/run/log/hostd.log, as lnav's vmw_log samples show it: the severity's code and a number
# after the stamp
# constructed 2023-08-08T15:08:36.834Z Er(179) Hostd[2100132]: failed to open the pump ⇒ {"rule": "syslog", "level": "error", "name": "Hostd", "message": "failed to open the pump", "stamp": "2023-08-08T15:08:36.834Z"}
# constructed 2023-08-08T15:08:36.834Z In(166) Hostd[2100132]: pump started ⇒ {"rule": "syslog", "level": "info", "leveled": true, "name": "Hostd", "message": "pump started"}
# constructed 2023-08-08T15:08:36.834Z Db(167) Hostd[2100132]: [Originator@6876 sub=Pump] polling ⇒ {"rule": "syslog", "level": "debug", "name": "Hostd", "message": "[Originator@6876 sub=Pump] polling"}
# constructed 2023-08-08T15:08:36.834Z Xx(179) Hostd[2100132]: no severity's code ⇒ {"rule": "syslog", "level": "info", "leveled": false, "name": "Hostd", "message": "no severity's code"}
