Structured logs can contain nested keys with dots in their names, which can confuse parsers that treat dots as path separators. Setting a custom delimiter keeps the log structure intact and prevents fields from being split or misread. That matters when routing, filtering, or querying logs depends on stable field names.
Why syslog-ng can misread dotted keys in structured logs
structured logs often use dotted field names to represent nested objects, but syslog-ng may interpret dots as hierarchy or path separators during parsing. That creates ambiguity between a literal key name and a structured path, which can alter how the event is materialised. A custom key delimiter tells the parser where one key ends and another begins.
When that delimiter is not explicit, the same event can be split into different fields depending on parser settings, destination format, or downstream template logic. The practical issue is not the dot itself, but the parser’s assumption about what the dot means in context. Stable parsing depends on making that boundary unambiguous.
That matters most when the log pipeline uses field names for routing, filtering, correlation, or enrichment. If a parser rewrites or fragments keys, rules may stop matching, dashboards may miss fields, and alerts can become inconsistent. In other words, the delimiter is a structural control, not just a formatting preference.
When custom delimiters become necessary in real pipelines
A custom key delimiter is usually needed when the source system emits nested or compound keys that already contain punctuation, and the downstream parser expects a different structure. Common cases include application logs that flatten JSON-like data, instrumentation that names fields with dots, and log shippers that serialise nested objects into text before syslog-ng receives them.
It also becomes important when multiple tools touch the same event format. One component may preserve dotted keys as literal names, while another may treat the same dots as path markers. If those assumptions differ, the log can still be syntactically valid but semantically wrong, which is harder to detect than a hard parse failure.
- Use an explicit delimiter when field names are part of operational logic, not just human readability.
- Validate the final parsed event, not only the raw message, before changing routing or SIEM rules.
- Prefer one consistent naming convention across producers if you control the emitting application.
For teams standardising log pipelines, the control is about preserving event fidelity end to end. When a parser can no longer distinguish between nesting and naming, the safest fix is usually to make the structure explicit at ingestion rather than relying on implicit interpretation.
Risk and Threat Considerations
Misparsed structured logs create operational and security risk because field-level logic depends on stable names. If a key is split, renamed, or collapsed during ingestion, detection rules, forensic queries, and automated routing can all produce false negatives or misleading results.
Failure mechanism: The parser treats punctuation as structure instead of literal content, so a dotted key is reconstructed incorrectly and downstream consumers read the wrong field set.
Impact: Security teams may lose visibility into important attributes, event correlation can break, and investigations may miss the exact data needed to prove what happened.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 8 — Audit Log Management | Preserving parsed log fields supports reliable audit logging and searchability. |
| Recommendation — Standardise log parsing so audit fields remain intact and queryable. | ||
| NIST CSF 2.0 | PR.PT — Protective Technology | Parser configuration is a protective control that preserves event integrity in the logging pipeline. |
| DE.CM — Continuous Monitoring | Stable field names are required for monitoring, filtering and detection logic to work consistently. | |
| Recommendation — Configure log parsers to preserve field integrity across ingestion and routing. Validate parsed log structure so monitoring logic sees consistent fields. | ||
Practitioner Guidance
What to verify: Confirm how syslog-ng tokenises keys for the exact input format you ingest, then compare raw events with parsed output before you depend on any field name in a rule or query. If the source can emit dotted keys, test one representative event with nested and non-nested variants.
Common mistake: Treating the delimiter choice as a formatting detail after the pipeline is already in production. In practice, it is a contract between producers, parsers, and consumers, so changing it late can invalidate searches, filters, and dashboards.
Practitioner takeaway: Choose the delimiter to preserve the meaning of the emitted structure, then lock that choice across parsing and downstream analytics so field names remain stable enough for automation.
Related resources from NHI Mgmt Group
- What do teams get wrong when forwarding Kubernetes logs to Loki through a syslog-ng pipeline?
- What do teams get wrong when they add custom roles and fine-grained permissions?
- What do teams get wrong when they assume MCP logs are enough for accountability?
- How should organisations govern custom alerts once they are in place?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
