policy

Loads a YAML policy file that can select the transformation mode and rename or drop keys before processing.

This parameter applies to JSON Dotted Key Transformer (mmjsontransform).

Name:: policy
Scope:: input
Type:: string
Default:: unset
Required?:: no
Introduced:: 8.2602.0

Description

When set, mmjsontransform loads a YAML policy file during startup and re-checks it on HUP. When policyWatch is enabled, the same file can also be reloaded automatically after watched updates. If reload fails, the previous in-memory policy is kept. The current implementation supports these sections:

mode: Selects unflatten or flatten from the policy file. When present, this overrides the action parameter on startup and after a successful HUP reload.
map.rename: Mapping of source keys to destination keys. Both keys are dotted JSON paths.
map.drop: Sequence of dotted JSON paths that should be removed before transformation.

The policy is applied before the selected transformation mode runs. This makes it possible to drop noisy fields, normalize names, and switch between flatten and unflatten from one reloadable file.

input and output remain action parameters because they define which message properties are read and written; the policy file only controls the transformation behavior.

If rsyslog is compiled without libyaml support, setting policy produces a configuration error.

Input usage

action(type="mmjsontransform"
       policy="/etc/rsyslog/mmjsontransform-policy.yaml"
       policyWatch="on"
       policyWatchDebounce="500ms"
       input="$!raw" output="$!normalized")

Example policy file

version: 1
mode: unflatten
map:
  rename:
    "usr": "user.name"
    "ctx.old": "ctx.new"
  drop:
    - "debug"

policy

Description

Input usage

Example policy file

See also