# fields

Defines the array of values that mmdarwin forwards to Darwin as parameters.

This parameter applies to Darwin connector (mmdarwin).

Name:

  fields

Scope:

  input

Type:

  array

Default:

  input=none

Required?:

  yes

Introduced:

  at least 8.x, possibly earlier

## Description

Array containing values to be sent to Darwin as parameters.

Two types of values can be set:

- if it starts with a bang (`"!"`) or a dot (`"."`), mmdarwin will search in the JSON-parsed log line (`"!"`) or in rsyslog local variables (`"."`) for the associated value. For nested properties, use additional bangs as separators (for example, `"!data!status"` reads the `"status"` property inside the `"data"` object).

- otherwise, the value is considered static, and will be forwarded directly to Darwin.

For example, given the following log line:

    {
        "from": "192.168.1.42",
        "date": "2012-12-21 00:00:00",
        "status": "200",
        "data": {
            "status": true,
            "message": "Request processed correctly"
        }
    }

and the `"fields"` array:

    ["!from", "!data!status", "rsyslog"]

The parameters sent to Darwin would be `"192.168.1.42"`, `true` and `"rsyslog"`.

Note

The order of the parameters is important and must match the order expected by the Darwin filter. Refer to Darwin documentation to see what each filter requires as parameters.

## Input usage

    action(type="mmdarwin" fields=["!from", "!data!status", "rsyslog"])

## See also

See also Darwin connector (mmdarwin).

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.