Generic JSON Collector | LogRhythm Documentation

This feature is supported for 64-bit Windows System Monitor Agents running version 7.20.0 or later, in environments with a core version of 7.20.0 or higher.

The 64-bit System Monitor Agent can begin consuming JSON data from third-party or custom collectors on ports 6044 (TCP) and 7044 (UDP) by default once the Enable JSON Parsing option is enabled in the System Monitor Basic Properties.

Any JSON data can be sent to the System Monitor from a third-party tool or custom collector, and you can create a custom policy file or create a custom log source for data classification and event generation.

When the System Monitor service starts with JSON parsing enabled, two new ports are set up to listen for generic JSON data: one for TCP and another for UDP. Users can enable, disable, or modify the port settings in the JSON Parser Group in the System Monitor Advanced Properties.

Starting with LogRhythm SIEM version 7.24 and Open Collector version 2026.04, your own secure SSL certificates can be used to configure System Monitor Agents and the JSON Listener. See the JSON Parser section of the Modify System Monitor Advanced Properties topic for more information.

Generic JSON Parsing Process

The Generic JSON Collector processes incoming data through the following pipeline:

Listen: The agent listens on configurable TCP and UDP ports for incoming JSON data.
Convert: Raw byte streams are converted to JSON objects.
Filter: Each JSON object is matched against loaded policy files using filter expressions.
Parse: The matching policy's transforms map JSON fields to LogRhythm schema fields.
Output: Parsed records are forwarded to the mediator for indexing.

Prerequisites

Before creating custom policy files or log sources, ensure the following:

You have System Monitor Agent version 7.20.0 or higher (64-bit Windows) installed.
JSON Parsing is enabled on the agent:

In the SIEM console, navigate to Deployment Manager > System Monitors.
Open the System Monitor properties.
On the Basic tab, check Enable JSON Parsing.
On the Advanced tab, expand the JSON Parser Group to configure ports as follows:

Agent Advanced Property	Range	Default	Description
`GenericTCPListeningPort`	Any valid port number	`6044`	The TCP port on which the agent listens for JSON data from a third-party or custom collector.
`GenericTCPListeningPortEnabled`	Enabled / Disabled	Enabled	Enables or disables the TCP listening port for generic JSON data.
`GenericUDPListeningPort`	Any valid port number	`7044`	The UDP port on which the agent listens for JSON data from a third-party or custom collector.
`GenericUDPListeningPortEnabled`	Enabled / Disabled	Enabled	Enables or disables the UDP listening port for generic JSON data.

Policy Files

A policy file is a JSON file that tells the Generic JSON Collector how to:

Identify which incoming JSON messages belong to a specific source (using a filter); and
Map JSON fields to LR schema fields (using transforms).

For information on using the LogRhythm Policy Builder to create or edit your own custom policies, refer to the JSON Policy Builder documentation.

Custom Policy File Locations

Custom policy files are stored in the following directory on the agent machine:

Directory	Purpose
`<agent_config>\\policies\\custompolicies\\`	Your custom policies. Place all custom .json files here.

The directory is created automatically the first time the System Monitor Agent starts with JSON parsing enabled.

On a default installation, the custom policies directory is:

C:\Program Files\LogRhythm\LogRhythm System Monitor\policies\custompolicies\

Custom policies are evaluated before system policies, meaning a custom policy for a source type takes precedence over a matching system policy.

Starting with LogRhythm SIEM version 7.26.0, System Monitor .NET8 Agents no longer contain physical policy files on disk at the \LogRhythm System Monitor\policies\ location. For more information, refer to Centralized JSON Policy Management.

System Monitor .NET4 Agents maintain physical files on disk at this time.

Obtain Diagnostic Metadata in Generic JSON Collector Logs

Logs collected through the Generic JSON Collector (port 6044) automatically include agent version and JSON policy name metadata, just like the Beats JSON Listener (port 5044). This gives administrators direct diagnostic context when investigating collection and parsing issues.

When escalating an issue to support, the agent version and JSON policy name are directly visible in the log. You can provide this information immediately without performing manual configuration lookups.

With the release of LogRhythm SIEM version 7.26.0 in October 2026, the Generic Collector now supports “pretty JSON” and “NL JSON” for the generation of these logs.

What Metadata Is Included

Logs received on port 6044 include two additional fields:

Agent version, the version of the Beat that sent the log.
JSON policy name, the name of the JSON policy that was applied when the log was collected.

The format of these fields matches the metadata already present in port 5044 logs.

Use the Metadata for Troubleshooting

This metadata can be used to diagnose parsing failures. When logs are not parsing as expected, check the JSON policy name field to confirm the correct policy is being applied to the incoming data. If the wrong policy is listed, review the policy assignment for that Beat in your Open Collector configuration.

You can also use this data to identify version-related issues. If you suspect a specific Beat version is causing collection or parsing problems, check the agent version field in the affected logs. This allows you to confirm exactly which version is sending data and determine whether an upgrade or rollback is appropriate, without manually reviewing agent configurations.

The JSON policy name field lets you verify that expected policies are being applied consistently across all Beat deployments feeding into port 6044.