content_image/758768.jpg
• log_sink_internal , log_sink_test : These sinks write to file_name . 

• log_sink_json : Successive instances of this sink named in the log_error_services  value write to files named file_name  plus a numbered . NN .json  suffix: file_name .00.json , file_name .01.json , and so forth. 

• log_sink_syseventlog : This sink writes to the system log, regardless of the log_error  value. 

## 5.4.2.3 Error Event Fields 

Error events intended for the error log contain a set of fields, each of which consists of a key/value pair. An event field may be classified as core, optional, or user-defined: 

•A core field is set up automatically for error events. However, its presence in the event during event processing is not guaranteed because a core field, like any type of field, may be unset by a log filter. If this happens, the field cannot be found by subsequent processing within that filter and by components that execute after the filter (such as log sinks). 

•An optional field is normally absent but may be present for certain event types. When present, an optional field provides additional event information as appropriate and available. 

•A user-defined field is any field with a name that is not already defined as a core or optional field. A user- defined field does not exist until created by a log filter. 

As implied by the preceding description, any given field may be absent during event processing, either because it was not present in the first place, or was discarded by a filter. For log sinks, the effect of field absence is sink specific. For example, a sink might omit the field from the log message, indicate that the field is missing, or substitute a default. When in doubt, test: use a filter that unsets the field, then check what the log sink does with it. 

The following sections describe the core and optional error event fields. For individual log filter components, there may be additional filter-specific considerations for these fields, or filters may add user- defined fields not listed here. For details, see the documentation for specific filters. 

## Core Error Event Fields 

•Core Error Event Fields 

•Optional Error Event Fields 

These error event fields are core fields: 

## • time 

The event timestamp, with microsecond precision. 

## • msg 

The event message string. 

## • prio 

The event priority, to indicate a system, error, warning, or note/information event. This field corresponds to severity in syslog . The following table shows the possible priority levels. 

<img src='content_image/758768.jpg'>

