Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between the JSON, CEF and Plain Text message formats for log forwarding?
Short answer
The three are formats of the body of the Syslog message and are selected in the Message Format field in the TR7 Log Forwarding profile; the default is JSON. JSON is a structured format: it carries timestamp, source, severity, message and the additional fields of the log with separate keys; it is easily processed by both machines and humans. CEF (Common Event Format) is the security industry's standard with a header separated by | and a key=value extension, and is suitable for SIEM correlation. Plain Text is single-line text without a structured layout: <timestamp> [SEVERITY] [source] message. In all three formats, severity takes the value info, warning, error or critical (written in uppercase in Plain Text); in the CEF header, these are mapped to 3, 5, 7 and 10 respectively.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → General Settings → Log Forwarding → Add | Message Format: JSON (default) / CEF (Common Event Format) / Plain Text | The body format of User, Notification, GTM and Health Check logs and, if the profile is selected in the Quarantine Log Forwarding field of the route table, of L4 DDoS quarantine entries |
| Same form, while User Logs is selected in Log sources | Send Change Details | Sending the change list with the changeCount and changes (list) fields in JSON, with the changeCount and changes extension fields in CEF, and by appending | changes: … to the end of the message in Plain Text |
| AGS → Integrations → Log Forwarding | Message Format: JSON / CEF (Common Event Format) | The body format of AGS audit events (there is no Plain Text) |
Comparison
| JSON | CEF | Plain Text | |
|---|---|---|---|
| Structure | Keyed fields | Header + key=value extension | Single-line text |
| Example start | {"timestamp":"…","source":"…","severity":"info",…} | CEF:0|TR7|LogTransport|1.0|… | 2026-10-05T09:00:00.000Z [INFO] [source] … |
| Where it fits | General log systems, programmatic processing | SIEMs that expect CEF | Human reading, simple Syslog servers |
| TR7 default | Yes | No | No |
- vService access logs are formatted not with this field but with the Line Format field of the Logs profile; TR7 JSON Format, CEF Format and the other line formats are found there.
Common Misconceptions
- "Message format and Syslog format are the same thing." Syslog format determines the header (RFC 3164/5424), and Message format the body (What is the difference between the RFC 3164 (BSD) and RFC 5424 Syslog formats?).
- "vService traffic logs are also formatted from this field." Traffic logs are formatted with the Line format field of the Logs profile.
- "The log text always goes in English." The text in the message body is sent translated according to the Log Language field of the profile (English or Türkçe).
How it is done in the documentation
