# Message Modification Modules

Message modification modules are used to change the content of messages being processed. They can be implemented using either the output module or the parser module interface. From the rsyslog core’s point of view, they actually are output or parser modules, it is their implementation that makes them special.

- AI-based classification (mmaitag)
- IP Address Anonymization Module (mmanon)
- Linux Audit Log Parser (mmaudit)
- mmcount
- Darwin connector (mmdarwin)
- MaxMind/GeoIP DB lookup (mmdblookup)
- Support module for external message modification modules
- Fields Extraction Module (mmfields)
- JSON Structured Content Extraction Module (mmjsonparse)
- JSON Dotted Key Rewriter (mmjsonrewrite)
- Purpose
- Failure conditions
- Configuration Parameters
- Conflict handling
- Examples
- Troubleshooting
- JSON Dotted Key Transformer (mmjsontransform)
- Purpose
- Failure conditions
- Notable Features
- Configuration Parameters
- Transformation modes
- Conflict handling
- Examples
- Troubleshooting
- Kubernetes Metadata Module (mmkubernetes)
- LEEF Structured Content Extraction Module (mmleefparse)
- Purpose
- Parsing Result
- Configuration Parameters
- Examples
- Log Message Normalization Module (mmnormalize)
- RFC5424 structured data parsing module (mmpstrucdata)
- Configuration Parameters
- mmrfc5424addhmac
- mmrm1stspace: First Space Modification Module
- Number generator and counter module (mmsequence)
- mmsnareparse - NXLog Snare Windows Security parser
- mmsnmptrapd message modification module
- mmtaghostname: message modification module
- Fix invalid UTF-8 Sequences (mmutf8fix)

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.