It would be nice if the actual sandbox decoder implementation were here (nginx, rsyslog)