@version: 3.35

@define allow-config-dups 1

options {
  stats_freq (0);
  ts_format(iso);
  flush_lines (0);
  time_reopen (10);
  log-iw-size (10000);
  log-fifo-size (10000);
  chain_hostnames (off);
  use_dns (yes);
  use_fqdn (yes);
  create_dirs (yes);
  owner ("system");
  group ("log");
  perm (0660);
  dir_owner ("system");
  dir_group ("log");
  dir_perm (0750);
  keep_hostname (yes);
  mark_mode(none);
  mark_freq(0);
  suppress(30);
};

source src {
  systemd-journal(prefix(".SDATA.journald."));
  internal();
};

rewrite r_add_monotonic_timestamp {
  set("$(/ ${.SDATA.journald._SOURCE_MONOTONIC_TIMESTAMP} 1000000)" value("TIMESTAMP_DIGIT"));
  set("$(% ${.SDATA.journald._SOURCE_MONOTONIC_TIMESTAMP} 1000000)" value("TIMESTAMP_DECIMAL"));
  set("$(padding ${TIMESTAMP_DIGIT} 5)" value("TIMESTAMP_DIGIT") condition("$(length ${TIMESTAMP_DIGIT})" < "5"));
  set("$(padding ${TIMESTAMP_DECIMAL} 6 0)" value("TIMESTAMP_DECIMAL"));
  set("$(substr ${TIMESTAMP_DIGIT} -5)" value("TIMESTAMP_DIGIT") condition("$(substr ${TIMESTAMP_DIGIT} -5 1)" eq " "));
  set("$(substr ${TIMESTAMP_DECIMAL} -6)" value("TIMESTAMP_DECIMAL"));
  set("[${TIMESTAMP_DIGIT}.${TIMESTAMP_DECIMAL}] ${MESSAGE}" value("MESSAGE"));
};

filter f_messages {
  level(warn..emerg)
};
destination messages { file("/var/log/messages"); };
log {
  source(src);
  filter(f_messages);
  if (facility(kern) and "${.SDATA.journald._SOURCE_MONOTONIC_TIMESTAMP}" ne "") {
    rewrite(r_add_monotonic_timestamp);
  };
  destination(messages);
};