$PreserveFQDN on

$template ls_json,"{%timestamp:::date-rfc3339,jsonf:@timestamp%,%source:::jsonf:@source_host%,\"@source\":\"syslog://%fromhost-ip:::json%\",\"@message\":\"%timestamp% %app-name%:%msg:::json%\",\"@fields\":{%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%}}\n"

$template systemjsonfile,"/var/logs/%$year%%$month%/%$year%%$month%%$day%.%HOSTNAME%.system.json"

*.* ?systemjsonfile;ls_json