rewrite r_add_monotonic_timestamp {
  set("$(/ ${.SDATA.journald._SOURCE_MONOTONIC_TIMESTAMP} 1000000)" value("TIMESTAMP_DIGIT"));
  set("$(% ${.SDATA.journald._SOURCE_MONOTONIC_TIMESTAMP} 1000000)" value("TIMESTAMP_DECIMAL"));
  set("$(padding ${TIMESTAMP_DIGIT} 5)" value("TIMESTAMP_DIGIT") condition("$(length ${TIMESTAMP_DIGIT})" < "5"));
  set("$(padding ${TIMESTAMP_DECIMAL} 6 0)" value("TIMESTAMP_DECIMAL"));
  set("$(substr ${TIMESTAMP_DIGIT} -5)" value("TIMESTAMP_DIGIT") condition("$(substr ${TIMESTAMP_DIGIT} -5 1)" eq " "));
  set("$(substr ${TIMESTAMP_DECIMAL} -6)" value("TIMESTAMP_DECIMAL"));
  set("[${TIMESTAMP_DIGIT}.${TIMESTAMP_DECIMAL}] ${MESSAGE}" value("MESSAGE"));
};
filter f_kernel {
facility(kern)
and level(notice..emerg)
@include "/etc/syslog-ng/patterndb.d/include/not2kern/"
@include "/usr/local/etc/syslog-ng/patterndb.d/include/not2kern/"
};
filter f_have_monotonic_timestamp {
  "${.SDATA.journald._SOURCE_MONOTONIC_TIMESTAMP}" != ""
};
filter f_audit {
  message("(<audit-[0-9]+>|audit:|audit_printk_skb:) ");
};
destination d_kernel { file("/var/log/kern.log"); };
log {
  source(src);
  filter(f_kernel);
  if {
    filter(f_have_monotonic_timestamp);
    rewrite(r_add_monotonic_timestamp);
  };
  destination(d_kernel);
};