Amavis is able to output an structured JSON log format. First make sure you syslog daemon allows log messages longer than 1500 bytes. For example in rsyslogd you can use the following configuration line to raise the maximum message size to 32k:
To activate JSON logging in amavisd you need to adjust the
$logline_maxlen setting since amavis will otherwise split long log lines at this threshold.
The log format in amavis is defined by the
$log_templ template. For JSON logging you have to use the
$logline_maxlen = ( 32*1024 ) - 50; # 32k max message size, keep 50 bytes for syslog $log_templ = <<'EOD'; [:report_json] EOD
For more macros take a look at the amavis documentation: