Json logging (for example for oidng) is broken

The json logging does not work correctly. The logstash appender that is for example used in in roles/oidcng/templates/logback.xml.j2 looks like this

 <appender name="JSON_SYSLOG" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
   <destination>host.docker.internal:514</destination>
    <encoder class="net.logstash.logback.encoder.LogstashEncoder">
        <customFields>{"app":"oidcng"}</customFields>
        <includeCallerData>true</includeCallerData>
        <fieldNames>
            <thread>[ignore]</thread>
            <version>[ignore]</version>
            <levelValue>[ignore]</levelValue>
       </fieldNames>
     </encoder>
  </appender>

This correctly format the json, but sends a Logstash-compatible message to a syslog port. In particular, it send pure json, whereas syslog instead expects an RFC3164 or RFC5452-compatible message. Such a syslog message contains a header followed by a message:

<PRIO> VERSION TIMESTAMP HOSTNAME APPNAME PROCID MSGID STRUC MESSAGE

for example:

<132> 1 20260507T12:00:00.000000+0200 docker1.dev.openconext.org oidcngjson - - - {"app":"oidng","more":"jsonfields"}

Using the current appender, rsyslog randoml interprets some of the json fields as its metadata fields cause for example the "servicename" to be {"@timestamp":.

This makes it impossible to match log messages and redirect them to the correct files.

Start with roles/oidcng/templates/logback.xml.j2 and compare the configured Logstash TCP appender with the syslog format described in the issue. Verify that the resulting messages are accepted as syslog by rsyslog, preserve the JSON payload, and can be routed to the correct files.