Amavis is able to output an structured JSON log format. First make sure you syslog daemon allows log messages longer than 1500 bytes. For example in rsyslogd you can use the following configuration line to raise the maximum message size to 32k:
$MaxMessageSize 32k
To activate JSON logging in amavisd you need to adjust the $logline_maxlen
setting since amavis will otherwise split long log lines at this threshold.
The log format in amavis is defined by the $log_templ
template. For JSON logging you have to use the report_json
macro:
$logline_maxlen = ( 32*1024 ) - 50; # 32k max message size, keep 50 bytes for syslog
$log_templ = <<'EOD';
[:report_json]
EOD
For more macros take a look at the amavis documentation: