rsyslogd: filter by content, split by separator in message, field creation and JSON formatting

Question

Happy 2021 to all!

I was trying to find a solution to handle my syslog’s messages. good part I got, but one of them I could not and I count on your help. Come on:

In my /var/log/syslog I have several lines of my monitoring. The steps I would like my rsyslog to perform:

1. if the syslog line contains "Actions: SERVICE ALERT:":

   • take the rest of the line (msg from Agios) and split by the character ";". There will be 6 fields.
   • field 1: first split
   • field 2: second split and etc.

2. with the fields and their values (key=value) create a json, including a field for date and another for time;

3. pass this json to a python script that will do some treatments (statistics generation) and write to a mongodb.

Script (item 3 I already created).... I need help on how to filter, how to transform into json, and how to run my script with json as a parameter .

Someone who’s still in a Christmas mood to help me with this matter?