# JSON Dotted Key Rewriter (mmjsonrewrite)

Module Name: | mmjsonrewrite
Author: | rsyslog project
Available since: | 8.2410.0

Warning

`mmjsonrewrite` is experimental. Parameter names and behavior may change without notice while the interface stabilizes. Expect breaking changes in future releases.

# Purpose

`mmjsonrewrite` scans a JSON object for property names that contain dot characters and rewrites those entries into nested objects. This mirrors the hierarchy that list templates create when `option.jsonfTree` is enabled, making it easier to normalize dotted payloads before forwarding them to downstream processors.

# Failure conditions

`mmjsonrewrite` aborts the action in the following situations:

- The input property does not resolve to a JSON object.

- The destination property already exists on the message.

- Rewriting a dotted path would overwrite an existing incompatible value.

# Configuration Parameters

Note

Parameter names are case-insensitive. CamelCase is recommended for readability.

## Action Parameters

Parameter | Summary
--- | ---
input | Names the JSON property that supplies the tree to rewrite.
output | Sets the destination property that receives the rewritten JSON tree.

# Conflict handling

When dotted paths collide with an existing scalar or incompatible container, `mmjsonrewrite` stops processing, leaves the output unset, and logs an error that includes the offending path. Review the reported path to adjust the upstream payload or choose a different destination.

# Examples

## Normalize dotted JSON properties

The following snippet converts dotted keys inside `$!raw` into nested objects stored under `$!structured`:

    module(load="mmjsonrewrite")
    module(load="imtcp")

    input(type="imtcp" port="10514" ruleset="rewrite-json")

    ruleset(name="rewrite-json") {
        action(type="mmjsonrewrite" input="$!raw" output="$!structured")
        action(type="omfile" file="/tmp/out.json"
               template="structured-json")
    }

    template(name="structured-json" type="string"
             string="%$!structured%\n")

# Troubleshooting

Conflicts usually stem from payloads that mix dotted keys with non-object values at the same hierarchy. Inspect the logged path, rename the conflicting key, or preprocess the message before running `mmjsonrewrite`.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.