Tersified from rsyslog.com properties, See it for the real deal.
msg rawmsg for debugging and forwarding unaltered.
EscapecontrolCharactersOnReceive is enabled by default, so it may be different from what was received rawmsg-after-pri the same as rawmsg, syslog PRI is removed. (avoid) hostname, source fromhost fromhost-ip system the message was received from (consider a relay) syslogtag TAG from the message programname "static" part of the tag, For example, when TAG is "named", programname is "named". pri pri-text with the numerical PRI appended in brackes (e.g. “local0.err<133>”) syslogfacility numerical syslogfacility-text syslogseverity, numerical syslogpriority syslogseverity-text, syslogpriority-text timereported, from the message timestamp Apr 17 21:10:31 Mon dd hh:mm:ss timegenerated message was RECEIVED. Always in high resolution (beware of timezone and sync timme variations) iut monitorware InfoUnitType fields from IETF draft protocol-version PROTCOL-VERSION structured-data STRUCTURED-DATA app-name APP-NAME procid PROCID msgid MSGID inputname input module that generated the message (e.g. “imuxsock”, “imudp”). jsonmesg as JSON representation. $bom UTF-8 encoded Unicode byte-order mask (BOM). $myhostname name of the current host $now not from the message. $now-utc Due to the complex handling of messages - including entry into a database - there are several subtly different timestamps available. Within a single template, only the localtime or UTC variant should be used. $now YYYY-MM-DD ¿ $year yyyy $month mm $day dd $hour hh $hhour current half hour 0 - 1 $qhour current quarter hour 0 - 3 $minute MM See property replacer to "pick apart various properties.