# create a conf file (/etc/rsyslog.d/10-mylog.conf) as follows
# then restart rsyslog: sudo /etc/init.d/rsyslog restart
# in this example, i search log entries for the word "sda"
# and log in text format in /var/log/hdt.log and in json in /var/log/hdj.log

module(load="mmjsonparse")

template(name="json-template"
  type="list") {
    constant(value="{")
  constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"@version\":\"1")
      constant(value="\",\"message\":\"")     property(name="msg" format="json")
      constant(value="\",\"sysloghost\":\"")  property(name="hostname")
      constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")
      constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")
      constant(value="\",\"programname\":\"") property(name="programname")
      constant(value="\",\"procid\":\"")      property(name="procid")
    constant(value="\"}\n")
}

:msg, contains, "sda" -/var/log/hdt.log
:msg, contains, "sda" -/var/log/hdj.log;json-template