I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings.

Problem is that values sometime include double-quotes themselves, and those need to be escaped - but I can't figure out how to do that.

Currently my rsyslog.conf contains this format that I use (a bit simplified):

$template JsonFormat,"{\"msg\":\"%msg%\",\"app-name\":\"%app-name%\"}\n",sql

But when a msg arrives that contains double quotes, the JSON is broken, example:

user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user="oracle" exe="/bin/su" (hostname=?, addr=?, terminal=?
result=Success)'

turns into:

{"msg":"user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user="oracle" exe="/bin/su" (hostname=?, addr=?, terminal=?
result=Success)'","app-name":"user"}

but what I need it to become is:

{"msg":"user pid=21214 uid=0 auid=4294967295 msg='PAM setcred:
user=\"oracle\" exe=\"/bin/su\" (hostname=?, addr=?, terminal=?
result=Success)'","app-name":"user"}