F5 DNS Logs in JSON Format

the key detail is that F5 DNS (GTM) does not natively emit logs in JSON format. The platform always originates logs in syslog format. Getting JSON output depends entirely on how you configure the log destination, and there are two clean paths to get there.

If you created a Remote Syslog type log destination, it will always produce syslog-formatted output regardless of what's downstream. You need to use a Remote High-Speed Log (HSL) destination and set the format explicitly.

In the GUI: System → Logs → Configuration → Log Destinations → Create

• Type: Remote High-Speed Log
• Pool: your syslog/SIEM pool
• Format: Splunk ← this is F5's label for JSON-formatted output

Yes, the option is called "Splunk" but it outputs standard JSON key-value pairs — it's not Splunk-specific. This is the native way to get JSON out of BIG-IP logging.

Then chain it:

1. Log Destination 1 — Remote HSL, Format: Splunk (JSON)
2. Log Destination 2 — Remote Syslog type pointing at Destination 1 (the "formatted" wrapper)
3. Log Publisher — references Destination 2
4. DNS Logging Profile — references the Log Publisher