diff --git a/MANIFEST b/MANIFEST
index c4c144a3b..3eea724a4 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -115,10 +115,18 @@ lib/eventlog/Makefile.in
 lib/eventlog/eventlog.c
 lib/eventlog/eventlog_conf.c
 lib/eventlog/eventlog_free.c
+lib/eventlog/eventlog_json.h
 lib/eventlog/logwrap.c
+lib/eventlog/parse_json.c
 lib/eventlog/regress/logwrap/check_wrap.c
 lib/eventlog/regress/logwrap/check_wrap.in
 lib/eventlog/regress/logwrap/check_wrap.out.ok
+lib/eventlog/regress/parse_json/check_parse_json.c
+lib/eventlog/regress/parse_json/test1.in
+lib/eventlog/regress/parse_json/test2.in
+lib/eventlog/regress/parse_json/test2.out.ok
+lib/eventlog/regress/parse_json/test3.in
+lib/eventlog/regress/parse_json/test3.out.ok
 lib/fuzzstub/Makefile.in
 lib/fuzzstub/fuzzstub.c
 lib/iolog/Makefile.in
@@ -132,7 +140,6 @@ lib/iolog/iolog_filter.c
 lib/iolog/iolog_flush.c
 lib/iolog/iolog_gets.c
 lib/iolog/iolog_json.c
-lib/iolog/iolog_json.h
 lib/iolog/iolog_legacy.c
 lib/iolog/iolog_loginfo.c
 lib/iolog/iolog_mkdirs.c
@@ -197,12 +204,6 @@ lib/iolog/regress/iolog_filter/test3/timing
 lib/iolog/regress/iolog_filter/test3/ttyin
 lib/iolog/regress/iolog_filter/test3/ttyin.filtered
 lib/iolog/regress/iolog_filter/test3/ttyout
-lib/iolog/regress/iolog_json/check_iolog_json.c
-lib/iolog/regress/iolog_json/test1.in
-lib/iolog/regress/iolog_json/test2.in
-lib/iolog/regress/iolog_json/test2.out.ok
-lib/iolog/regress/iolog_json/test3.in
-lib/iolog/regress/iolog_json/test3.out.ok
 lib/iolog/regress/iolog_mkpath/check_iolog_mkpath.c
 lib/iolog/regress/iolog_path/check_iolog_path.c
 lib/iolog/regress/iolog_path/data
diff --git a/include/sudo_eventlog.h b/include/sudo_eventlog.h
index 0e30ec495..e1c535221 100644
--- a/include/sudo_eventlog.h
+++ b/include/sudo_eventlog.h
@@ -130,6 +130,7 @@ struct json_container;
 struct sudo_lbuf;
 typedef bool (*eventlog_json_callback_t)(struct json_container *, void *);
 
+/* eventlog.c */
 bool eventlog_accept(const struct eventlog *evlog, int flags, eventlog_json_callback_t info_cb, void *info);
 bool eventlog_exit(const struct eventlog *evlog, int flags);
 bool eventlog_alert(const struct eventlog *evlog, int flags, struct timespec *alert_time, const char *reason, const char *errstr);
@@ -137,8 +138,9 @@ bool eventlog_mail(const struct eventlog *evlog, int flags, struct timespec *eve
 bool eventlog_reject(const struct eventlog *evlog, int flags, const char *reason, eventlog_json_callback_t info_cb, void *info);
 bool eventlog_store_json(struct json_container *jsonc, const struct eventlog *evlog);
 bool eventlog_store_sudo(int event_type, const struct eventlog *evlog, struct sudo_lbuf *lbuf);
-size_t eventlog_writeln(FILE *fp, char *line, size_t len, size_t maxlen);
 void eventlog_free(struct eventlog *evlog);
+
+/* eventlog_conf.c */
 void eventlog_set_type(int type);
 void eventlog_set_format(enum eventlog_format format);
 void eventlog_set_syslog_acceptpri(int pri);
@@ -159,4 +161,13 @@ void eventlog_set_open_log(FILE *(*fn)(int type, const char *));
 void eventlog_set_close_log(void (*fn)(int type, FILE *));
 const struct eventlog_config *eventlog_getconf(void);
 
+/* logwrap.c */
+size_t eventlog_writeln(FILE *fp, char *line, size_t len, size_t maxlen);
+
+/* parse_json.c */
+struct eventlog_json_object;
+struct eventlog_json_object *eventlog_json_read(FILE *fp, const char *filename);
+bool eventlog_json_parse(struct eventlog_json_object *object, struct eventlog *evlog);
+void eventlog_json_free(struct eventlog_json_object *root);
+
 #endif /* SUDO_EVENTLOG_H */
diff --git a/lib/eventlog/Makefile.in b/lib/eventlog/Makefile.in
index cd713c483..e4a6f5b36 100644
--- a/lib/eventlog/Makefile.in
+++ b/lib/eventlog/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2020 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2020-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -81,10 +81,11 @@ DEVEL = @DEVEL@
 
 SHELL = @SHELL@
 
-TEST_PROGS = check_wrap
+TEST_PROGS = check_wrap check_parse_json
 TEST_VERBOSE =
 
-LIBEVENTLOG_OBJS = eventlog.lo eventlog_conf.lo eventlog_free.lo logwrap.lo
+LIBEVENTLOG_OBJS = eventlog.lo eventlog_conf.lo eventlog_free.lo logwrap.lo \
+		   parse_json.lo
 
 IOBJS = $(LIBEVENTLOG_OBJS:.lo=.i)
 
@@ -92,6 +93,8 @@ POBJS = $(IOBJS:.i=.plog)
 
 CHECK_WRAP_OBJS = check_wrap.lo logwrap.lo
 
+CHECK_PARSE_JSON_OBJS = check_parse_json.lo parse_json.lo
+
 all: libsudo_eventlog.la
 
 depend:
@@ -116,6 +119,9 @@ Makefile: $(srcdir)/Makefile.in
 libsudo_eventlog.la: $(LIBEVENTLOG_OBJS) $(LT_LIBS)
 	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(LIBEVENTLOG_OBJS) $(LT_LIBS)
 
+check_parse_json: $(CHECK_PARSE_JSON_OBJS)
+	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(CHECK_PARSE_JSON_OBJS) $(LDFLAGS) $(ASAN_LDFLAGS) $(PIE_LDFLAGS) $(HARDENING_LDFLAGS) $(LIBS)
+
 check_wrap: $(CHECK_WRAP_OBJS) $(LIBUTIL)
 	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(CHECK_WRAP_OBJS) $(LDFLAGS) $(ASAN_LDFLAGS) $(PIE_LDFLAGS) $(HARDENING_LDFLAGS) $(LIBS)
 
@@ -161,6 +167,7 @@ check: $(TEST_PROGS) check-fuzzer
 	    MALLOC_CONF="abort:true,junk:true"; export MALLOC_CONF; \
 	    umask 022; \
 	    rval=0; \
+	    ./check_parse_json $(srcdir)/regress/parse_json/*.in || rval=`expr $$rval + $$?`; \
 	    mkdir -p regress/logwrap; \
 	    ./check_wrap $(srcdir)/regress/logwrap/check_wrap.in > regress/logwrap/check_wrap.out; \
 	    diff regress/logwrap/check_wrap.out $(srcdir)/regress/logwrap/check_wrap.out.ok || rval=`expr $$rval + $$?`; \
@@ -189,6 +196,20 @@ cleandir: realclean
 .PHONY: clean mostlyclean distclean cleandir clobber realclean
 
 # Autogenerated dependencies, do not modify
+check_parse_json.lo: $(srcdir)/regress/parse_json/check_parse_json.c \
+                     $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
+                     $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
+                     $(incdir)/sudo_plugin.h $(incdir)/sudo_util.h \
+                     $(top_builddir)/config.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/parse_json/check_parse_json.c
+check_parse_json.i: $(srcdir)/regress/parse_json/check_parse_json.c \
+                     $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
+                     $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
+                     $(incdir)/sudo_plugin.h $(incdir)/sudo_util.h \
+                     $(top_builddir)/config.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+check_parse_json.plog: check_parse_json.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/parse_json/check_parse_json.c --i-file $< --output-file $@
 check_wrap.lo: $(srcdir)/regress/logwrap/check_wrap.c \
                $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
                $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
@@ -207,17 +228,17 @@ eventlog.lo: $(srcdir)/eventlog.c $(incdir)/compat/stdbool.h \
              $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
              $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
              $(incdir)/sudo_gettext.h $(incdir)/sudo_json.h \
-             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-             $(incdir)/sudo_util.h $(top_builddir)/config.h \
-             $(top_builddir)/pathnames.h
+             $(incdir)/sudo_lbuf.h $(incdir)/sudo_plugin.h \
+             $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+             $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/eventlog.c
 eventlog.i: $(srcdir)/eventlog.c $(incdir)/compat/stdbool.h \
              $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
              $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
              $(incdir)/sudo_gettext.h $(incdir)/sudo_json.h \
-             $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-             $(incdir)/sudo_util.h $(top_builddir)/config.h \
-             $(top_builddir)/pathnames.h
+             $(incdir)/sudo_lbuf.h $(incdir)/sudo_plugin.h \
+             $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+             $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 eventlog.plog: eventlog.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/eventlog.c --i-file $< --output-file $@
@@ -263,3 +284,19 @@ logwrap.i: $(srcdir)/logwrap.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 logwrap.plog: logwrap.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/logwrap.c --i-file $< --output-file $@
+parse_json.lo: $(srcdir)/parse_json.c $(incdir)/compat/stdbool.h \
+               $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
+               $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
+               $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
+               $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+               $(top_builddir)/config.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/parse_json.c
+parse_json.i: $(srcdir)/parse_json.c $(incdir)/compat/stdbool.h \
+               $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
+               $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
+               $(incdir)/sudo_gettext.h $(incdir)/sudo_plugin.h \
+               $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
+               $(top_builddir)/config.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+parse_json.plog: parse_json.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/parse_json.c --i-file $< --output-file $@
diff --git a/lib/eventlog/parse_json.c b/lib/eventlog/parse_json.c
new file mode 100644
index 000000000..28c777872
--- /dev/null
+++ b/lib/eventlog/parse_json.c
@@ -0,0 +1,934 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2020-2023 Todd C. Miller <Todd.Miller@sudo.ws>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This is an open source non-commercial project. Dear PVS-Studio, please check it.
+ * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
+ */
+
+#include <config.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#ifdef HAVE_STDBOOL_H
+# include <stdbool.h>
+#else
+# include "compat/stdbool.h"
+#endif /* HAVE_STDBOOL_H */
+#include <string.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <limits.h>
+#include <fcntl.h>
+#include <time.h>
+
+#include "sudo_compat.h"
+#include "sudo_debug.h"
+#include "sudo_eventlog.h"
+#include "sudo_fatal.h"
+#include "sudo_gettext.h"
+#include "sudo_util.h"
+
+#include "parse_json.h"
+
+struct json_stack {
+    unsigned int depth;
+    unsigned int maxdepth;
+    struct eventlog_json_object *frames[64];
+};
+#define JSON_STACK_INTIALIZER(s) { 0, nitems((s).frames) };
+
+static bool
+json_store_columns(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_columns, SUDO_DEBUG_UTIL);
+
+    if (item->u.number < 1 || item->u.number > INT_MAX) {
+	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+	    "tty cols %lld: out of range", item->u.number);
+	evlog->columns = 0;
+	debug_return_bool(false);
+    }
+
+    evlog->columns = item->u.number;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_command(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_command, SUDO_DEBUG_UTIL);
+
+    /*
+     * Note: struct eventlog must store command + args.
+     *       We don't have argv yet so we append the args later.
+     */
+    free(evlog->command);
+    evlog->command = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_dumped_core(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_dumped_core, SUDO_DEBUG_UTIL);
+
+    evlog->dumped_core = item->u.boolean;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_exit_value(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_exit_value, SUDO_DEBUG_UTIL);
+
+    if (item->u.number < 0 || item->u.number > INT_MAX) {
+	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+	    "exit value %lld: out of range", item->u.number);
+	evlog->exit_value = -1;
+	debug_return_bool(false);
+    }
+
+    evlog->exit_value = item->u.number;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_lines(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_lines, SUDO_DEBUG_UTIL);
+
+    if (item->u.number < 1 || item->u.number > INT_MAX) {
+	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+	    "tty lines %lld: out of range", item->u.number);
+	evlog->lines = 0;
+	debug_return_bool(false);
+    }
+
+    evlog->lines = item->u.number;
+    debug_return_bool(true);
+}
+
+static char **
+json_array_to_strvec(struct eventlog_json_object *array)
+{
+    struct json_item *item;
+    int len = 0;
+    char **ret;
+    debug_decl(json_array_to_strvec, SUDO_DEBUG_UTIL);
+
+    TAILQ_FOREACH(item, &array->items, entries) {
+	/* Can only convert arrays of string. */
+	if (item->type != JSON_STRING) {
+	    sudo_warnx(U_("expected JSON_STRING, got %d"), item->type);
+	    debug_return_ptr(NULL);
+	}
+	/* Prevent integer overflow. */
+	if (++len == INT_MAX) {
+	    sudo_warnx("%s", U_("JSON_ARRAY too large"));
+	    debug_return_ptr(NULL);
+	}
+    }
+    if ((ret = reallocarray(NULL, len + 1, sizeof(char *))) == NULL) {
+	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
+	debug_return_ptr(NULL);
+    }
+    len = 0;
+    TAILQ_FOREACH(item, &array->items, entries) {
+	ret[len++] = item->u.string;
+	item->u.string = NULL;
+    }
+    ret[len] = NULL;
+
+    debug_return_ptr(ret);
+}
+
+static bool
+json_store_runargv(struct json_item *item, struct eventlog *evlog)
+{
+    int i;
+    debug_decl(json_store_runargv, SUDO_DEBUG_UTIL);
+
+    if (evlog->argv != NULL) {
+	for (i = 0; evlog->argv[i] != NULL; i++)
+	    free(evlog->argv[i]);
+	free(evlog->argv);
+    }
+    evlog->argv = json_array_to_strvec(&item->u.child);
+
+    debug_return_bool(evlog->argv != NULL);
+}
+
+static bool
+json_store_runenv(struct json_item *item, struct eventlog *evlog)
+{
+    int i;
+    debug_decl(json_store_runenv, SUDO_DEBUG_UTIL);
+
+    if (evlog->envp != NULL) {
+	for (i = 0; evlog->envp[i] != NULL; i++)
+	    free(evlog->envp[i]);
+	free(evlog->envp);
+    }
+    evlog->envp = json_array_to_strvec(&item->u.child);
+
+    debug_return_bool(evlog->envp != NULL);
+}
+
+static bool
+json_store_rungid(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_rungid, SUDO_DEBUG_UTIL);
+
+    evlog->rungid = (gid_t)item->u.number;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_rungroup(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_rungroup, SUDO_DEBUG_UTIL);
+
+    free(evlog->rungroup);
+    evlog->rungroup = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_runuid(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_runuid, SUDO_DEBUG_UTIL);
+
+    evlog->runuid = (uid_t)item->u.number;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_runuser(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_runuser, SUDO_DEBUG_UTIL);
+
+    free(evlog->runuser);
+    evlog->runuser = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_runchroot(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_runchroot, SUDO_DEBUG_UTIL);
+
+    free(evlog->runchroot);
+    evlog->runchroot = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_runcwd(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_runcwd, SUDO_DEBUG_UTIL);
+
+    free(evlog->runcwd);
+    evlog->runcwd = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_signal(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_signal, SUDO_DEBUG_UTIL);
+
+    free(evlog->signal_name);
+    evlog->signal_name = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_submitcwd(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_submitcwd, SUDO_DEBUG_UTIL);
+
+    free(evlog->cwd);
+    evlog->cwd = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_submithost(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_submithost, SUDO_DEBUG_UTIL);
+
+    free(evlog->submithost);
+    evlog->submithost = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_submituser(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_submituser, SUDO_DEBUG_UTIL);
+
+    free(evlog->submituser);
+    evlog->submituser = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static bool
+json_store_timespec(struct json_item *item, struct timespec *ts)
+{
+    struct eventlog_json_object *object;
+    debug_decl(json_store_timespec, SUDO_DEBUG_UTIL);
+
+    object = &item->u.child;
+    TAILQ_FOREACH(item, &object->items, entries) {
+	if (item->type != JSON_NUMBER)
+	    continue;
+	if (strcmp(item->name, "seconds") == 0) {
+	    ts->tv_sec = item->u.number;
+	    continue;
+	}
+	if (strcmp(item->name, "nanoseconds") == 0) {
+	    ts->tv_nsec = item->u.number;
+	    continue;
+	}
+    }
+    debug_return_bool(true);
+}
+
+static bool
+json_store_run_time(struct json_item *item, struct eventlog *evlog)
+{
+    return json_store_timespec(item, &evlog->run_time);
+}
+
+static bool
+json_store_timestamp(struct json_item *item, struct eventlog *evlog)
+{
+    return json_store_timespec(item, &evlog->submit_time);
+}
+
+static bool
+json_store_ttyname(struct json_item *item, struct eventlog *evlog)
+{
+    debug_decl(json_store_ttyname, SUDO_DEBUG_UTIL);
+
+    free(evlog->ttyname);
+    evlog->ttyname = item->u.string;
+    item->u.string = NULL;
+    debug_return_bool(true);
+}
+
+static struct evlog_json_key {
+    const char *name;
+    enum json_value_type type;
+    bool (*setter)(struct json_item *, struct eventlog *);
+} evlog_json_keys[] = {
+    { "columns", JSON_NUMBER, json_store_columns },
+    { "command", JSON_STRING, json_store_command },
+    { "dumped_core", JSON_BOOL, json_store_dumped_core },
+    { "exit_value", JSON_NUMBER, json_store_exit_value },
+    { "lines", JSON_NUMBER, json_store_lines },
+    { "run_time", JSON_OBJECT, json_store_run_time },
+    { "runargv", JSON_ARRAY, json_store_runargv },
+    { "runenv", JSON_ARRAY, json_store_runenv },
+    { "rungid", JSON_ID, json_store_rungid },
+    { "rungroup", JSON_STRING, json_store_rungroup },
+    { "runuid", JSON_ID, json_store_runuid },
+    { "runuser", JSON_STRING, json_store_runuser },
+    { "runchroot", JSON_STRING, json_store_runchroot },
+    { "runcwd", JSON_STRING, json_store_runcwd },
+    { "signal", JSON_STRING, json_store_signal },
+    { "submitcwd", JSON_STRING, json_store_submitcwd },
+    { "submithost", JSON_STRING, json_store_submithost },
+    { "submituser", JSON_STRING, json_store_submituser },
+    { "timestamp", JSON_OBJECT, json_store_timestamp },
+    { "ttyname", JSON_STRING, json_store_ttyname },
+    { NULL }
+};
+
+static struct json_item *
+new_json_item(enum json_value_type type, char *name, unsigned int lineno)
+{
+    struct json_item *item;
+    debug_decl(new_json_item, SUDO_DEBUG_UTIL);
+
+    if ((item = malloc(sizeof(*item))) == NULL)  {
+	sudo_warnx(U_("%s: %s"), __func__,
+	    U_("unable to allocate memory"));
+	debug_return_ptr(NULL);
+    }
+    item->name = name;
+    item->type = type;
+    item->lineno = lineno;
+
+    debug_return_ptr(item);
+}
+
+static char *
+json_parse_string(char **strp)
+{
+    char *dst, *end, *ret, *src = *strp + 1;
+    size_t len;
+    debug_decl(json_parse_string, SUDO_DEBUG_UTIL);
+
+    for (end = src; *end != '"' && *end != '\0'; end++) {
+	if (end[0] == '\\' && end[1] == '"')
+	    end++;
+    }
+    if (*end != '"') {
+	sudo_warnx("%s", U_("missing double quote in name"));
+	debug_return_str(NULL);
+    }
+    len = (size_t)(end - src);
+
+    /* Copy string, flattening escaped chars. */
+    dst = ret = malloc(len + 1);
+    if (dst == NULL) {
+	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
+	debug_return_str(NULL);
+    }
+    while (src < end) {
+	char ch = *src++;
+	if (ch == '\\') {
+	    switch (*src) {
+	    case 'b':
+		ch = '\b';
+		break;
+	    case 'f':
+		ch = '\f';
+		break;
+	    case 'n':
+		ch = '\n';
+		break;
+	    case 'r':
+		ch = '\r';
+		break;
+	    case 't':
+		ch = '\t';
+		break;
+	    case 'u':
+		/* Only currently handles 8-bit ASCII. */
+		if (src[1] == '0' && src[2] == '0') {
+		    ch = sudo_hexchar(&src[3]);
+		    if (ch != -1) {
+			src += 4;
+			break;
+		    }
+		}
+		/* Not in \u00XX format. */
+		FALLTHROUGH;
+	    case '"':
+	    case '\\':
+	    default:
+		/* Note: a bare \ at the end of a string will be removed. */
+		ch = *src;
+		break;
+	    }
+	    src++;
+	}
+	*dst++ = ch;
+    }
+    *dst = '\0';
+
+    /* Trim trailing whitespace. */
+    do {
+	end++;
+    } while (isspace((unsigned char)*end));
+    *strp = end;
+
+    debug_return_str(ret);
+}
+
+static void
+free_json_items(struct json_item_list *items)
+{
+    struct json_item *item;
+    debug_decl(free_json_items, SUDO_DEBUG_UTIL);
+
+    while ((item = TAILQ_FIRST(items)) != NULL) {
+	TAILQ_REMOVE(items, item, entries);
+	switch (item->type) {
+	case JSON_STRING:
+	    free(item->u.string);
+	    break;
+	case JSON_ARRAY:
+	case JSON_OBJECT:
+	    free_json_items(&item->u.child.items);
+	    break;
+	case JSON_ID:
+	case JSON_NUMBER:
+	case JSON_BOOL:
+	case JSON_NULL:
+	    /* Nothing to free. */
+	    break;
+	default:
+	    sudo_warnx("%s: internal error, invalid JSON type %d",
+		__func__, item->type);
+	    break;
+	}
+	free(item->name);
+	free(item);
+    }
+
+    debug_return;
+}
+
+void
+eventlog_json_free(struct eventlog_json_object *root)
+{
+    debug_decl(eventlog_json_free, SUDO_DEBUG_UTIL);
+    if (root != NULL) {
+	free_json_items(&root->items);
+	free(root);
+    }
+    debug_return;
+}
+
+bool
+eventlog_json_parse(struct eventlog_json_object *object, struct eventlog *evlog)
+{
+    struct json_item *item;
+    bool ret = false;
+    debug_decl(eventlog_json_parse, SUDO_DEBUG_UTIL);
+
+    /* First object holds all the actual data. */
+    item = TAILQ_FIRST(&object->items);
+    if (item == NULL) {
+	sudo_warnx("%s", U_("missing JSON_OBJECT"));
+	goto done;
+    }
+    if (item->type != JSON_OBJECT) {
+	sudo_warnx(U_("expected JSON_OBJECT, got %d"), item->type);
+	goto done;
+    }
+    object = &item->u.child;
+
+    TAILQ_FOREACH(item, &object->items, entries) {
+	struct evlog_json_key *key;
+
+	/* expecting key:value pairs */
+	if (item->name == NULL) {
+	    sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
+		"%s: missing object name", __func__);
+	    goto done;
+	}
+
+	/* lookup name */
+	for (key = evlog_json_keys; key->name != NULL; key++) {
+	    if (strcmp(item->name, key->name) == 0)
+		break;
+	}
+	if (key->name == NULL) {
+	    sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
+		"%s: unknown key %s", __func__, item->name);
+	} else if (key->type != item->type &&
+		(key->type != JSON_ID || item->type != JSON_NUMBER)) {
+	    sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
+		"%s: key mismatch %s type %d, expected %d", __func__,
+		item->name, item->type, key->type);
+	    goto done;
+	} else {
+	    /* Matched name and type. */
+	    if (!key->setter(item, evlog)) {
+		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
+		    "unable to store %s", key->name);
+		goto done;
+	    }
+	}
+    }
+
+    ret = true;
+
+done:
+    debug_return_bool(ret);
+}
+
+static bool
+json_insert_bool(struct json_item_list *items, char *name, bool value,
+    unsigned int lineno)
+{
+    struct json_item *item;
+    debug_decl(json_insert_bool, SUDO_DEBUG_UTIL);
+
+    if ((item = new_json_item(JSON_BOOL, name, lineno)) == NULL)
+	debug_return_bool(false);
+    item->u.boolean = value;
+    TAILQ_INSERT_TAIL(items, item, entries);
+
+    debug_return_bool(true);
+}
+
+static bool
+json_insert_null(struct json_item_list *items, char *name, unsigned int lineno)
+{
+    struct json_item *item;
+    debug_decl(json_insert_null, SUDO_DEBUG_UTIL);
+
+    if ((item = new_json_item(JSON_NULL, name, lineno)) == NULL)
+	debug_return_bool(false);
+    TAILQ_INSERT_TAIL(items, item, entries);
+
+    debug_return_bool(true);
+}
+
+static bool
+json_insert_num(struct json_item_list *items, char *name, long long value,
+    unsigned int lineno)
+{
+    struct json_item *item;
+    debug_decl(json_insert_num, SUDO_DEBUG_UTIL);
+
+    if ((item = new_json_item(JSON_NUMBER, name, lineno)) == NULL)
+	debug_return_bool(false);
+    item->u.number = value;
+    TAILQ_INSERT_TAIL(items, item, entries);
+
+    debug_return_bool(true);
+}
+
+static bool
+json_insert_str(struct json_item_list *items, char *name, char **strp,
+    unsigned int lineno)
+{
+    struct json_item *item;
+    debug_decl(json_insert_str, SUDO_DEBUG_UTIL);
+
+    if ((item = new_json_item(JSON_STRING, name, lineno)) == NULL)
+	debug_return_bool(false);
+    item->u.string = json_parse_string(strp);
+    if (item->u.string == NULL) {
+	free(item);
+	debug_return_bool(false);
+    }
+    TAILQ_INSERT_TAIL(items, item, entries);
+
+    debug_return_bool(true);
+}
+
+static struct eventlog_json_object *
+json_stack_push(struct json_stack *stack, struct json_item_list *items,
+    struct eventlog_json_object *frame, enum json_value_type type, char *name,
+    unsigned int lineno)
+{
+    struct json_item *item;
+    debug_decl(json_stack_push, SUDO_DEBUG_UTIL);
+
+    /* We limit the stack size rather than expanding it. */
+    if (stack->depth >= stack->maxdepth) {
+	sudo_warnx(U_("json stack exhausted (max %u frames)"), stack->maxdepth);
+	debug_return_ptr(NULL);
+    }
+
+    /* Allocate a new item and insert it into the list. */
+    if ((item = new_json_item(type, name, lineno)) == NULL)
+	debug_return_ptr(NULL);
+    TAILQ_INIT(&item->u.child.items);
+    item->u.child.parent = item;
+    TAILQ_INSERT_TAIL(items, item, entries);
+
+    /* Push the current frame onto the stack (depth check performed above). */
+    stack->frames[stack->depth++] = frame;
+
+    /* Return the new frame */
+    debug_return_ptr(&item->u.child);
+}
+
+/* Only expect a value if a name is defined or we are in an array. */
+#define expect_value (name != NULL || (frame->parent != NULL && frame->parent->type == JSON_ARRAY))
+
+struct eventlog_json_object *
+eventlog_json_read(FILE *fp, const char *filename)
+{
+    struct eventlog_json_object *frame, *root;
+    struct json_stack stack = JSON_STACK_INTIALIZER(stack);
+    unsigned int lineno = 0;
+    char *name = NULL;
+    char *cp, *buf = NULL;
+    size_t bufsize = 0;
+    ssize_t len;
+    bool saw_comma = false;
+    long long num;
+    char ch;
+    debug_decl(eventlog_json_read, SUDO_DEBUG_UTIL);
+
+    root = malloc(sizeof(*root));
+    if (root == NULL)
+	goto bad;
+
+    root->parent = NULL;
+    TAILQ_INIT(&root->items);
+
+    frame = root;
+    while ((len = getdelim(&buf, &bufsize, '\n', fp)) != -1) {
+	char *ep = buf + len - 1;
+	cp = buf;
+
+	lineno++;
+
+	/* Trim trailing whitespace. */
+	while (ep > cp && isspace((unsigned char)*ep))
+	    ep--;
+	ep[1] = '\0';
+
+	for (;;) {
+	    const char *errstr;
+
+	    /* Trim leading whitespace, skip blank lines. */
+	    while (isspace((unsigned char)*cp))
+		cp++;
+
+	    /* Check for comma separator and strip it out. */
+	    if (*cp == ',') {
+		saw_comma = true;
+		cp++;
+		while (isspace((unsigned char)*cp))
+		    cp++;
+	    }
+
+	    /* End of line? */
+	    if (*cp == '\0')
+		break;
+
+	    switch (*cp) {
+	    case '{':
+		if (name == NULL && frame->parent != NULL) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("objects must consist of name:value pairs"));
+		    goto bad;
+		}
+		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("missing separator between values"));
+		    goto bad;
+		}
+		cp++;
+		saw_comma = false;
+		frame = json_stack_push(&stack, &frame->items, frame,
+		    JSON_OBJECT, name, lineno);
+		if (frame == NULL)
+		    goto bad;
+		name = NULL;
+		break;
+	    case '}':
+		if (stack.depth == 0 || frame->parent == NULL ||
+			frame->parent->type != JSON_OBJECT) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unmatched close brace"));
+		    goto bad;
+		}
+		cp++;
+		frame = stack.frames[--stack.depth];
+		saw_comma = false;
+		break;
+	    case '[':
+		if (frame->parent == NULL) {
+		    /* Must have an enclosing object. */
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unexpected array"));
+		    goto bad;
+		}
+		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("missing separator between values"));
+		    goto bad;
+		}
+		cp++;
+		saw_comma = false;
+		frame = json_stack_push(&stack, &frame->items, frame,
+		    JSON_ARRAY, name, lineno);
+		if (frame == NULL)
+		    goto bad;
+		name = NULL;
+		break;
+	    case ']':
+		if (stack.depth == 0 || frame->parent == NULL ||
+			frame->parent->type != JSON_ARRAY) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unmatched close bracket"));
+		    goto bad;
+		}
+		cp++;
+		frame = stack.frames[--stack.depth];
+		saw_comma = false;
+		break;
+	    case '"':
+		if (frame->parent == NULL) {
+		    /* Must have an enclosing object. */
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unexpected string"));
+		    goto bad;
+		}
+
+		if (!expect_value) {
+		    /* Parse "name": */
+		    if ((name = json_parse_string(&cp)) == NULL)
+			goto bad;
+		    /* TODO: allow colon on next line? */
+		    if (*cp != ':') {
+			sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			    U_("missing colon after name"));
+			goto bad;
+		    }
+		    cp++;
+		} else {
+		    if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+			sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			    U_("missing separator between values"));
+			goto bad;
+		    }
+		    saw_comma = false;
+		    if (!json_insert_str(&frame->items, name, &cp, lineno))
+			goto bad;
+		    name = NULL;
+		}
+		break;
+	    case 't':
+		if (strncmp(cp, "true", sizeof("true") - 1) != 0)
+		    goto parse_error;
+		if (!expect_value) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unexpected boolean"));
+		    goto bad;
+		}
+		cp += sizeof("true") - 1;
+		if (*cp != ',' && !isspace((unsigned char)*cp) && *cp != '\0')
+		    goto parse_error;
+		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("missing separator between values"));
+		    goto bad;
+		}
+		saw_comma = false;
+
+		if (!json_insert_bool(&frame->items, name, true, lineno))
+		    goto bad;
+		name = NULL;
+		break;
+	    case 'f':
+		if (strncmp(cp, "false", sizeof("false") - 1) != 0)
+		    goto parse_error;
+		if (!expect_value) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unexpected boolean"));
+		    goto bad;
+		}
+		cp += sizeof("false") - 1;
+		if (*cp != ',' && !isspace((unsigned char)*cp) && *cp != '\0')
+		    goto parse_error;
+		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("missing separator between values"));
+		    goto bad;
+		}
+		saw_comma = false;
+
+		if (!json_insert_bool(&frame->items, name, false, lineno))
+		    goto bad;
+		name = NULL;
+		break;
+	    case 'n':
+		if (strncmp(cp, "null", sizeof("null") - 1) != 0)
+		    goto parse_error;
+		if (!expect_value) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unexpected null"));
+		    goto bad;
+		}
+		cp += sizeof("null") - 1;
+		if (*cp != ',' && !isspace((unsigned char)*cp) && *cp != '\0')
+		    goto parse_error;
+		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("missing separator between values"));
+		    goto bad;
+		}
+		saw_comma = false;
+
+		if (!json_insert_null(&frame->items, name, lineno))
+		    goto bad;
+		name = NULL;
+		break;
+	    case '+': case '-': case '0': case '1': case '2': case '3':
+	    case '4': case '5': case '6': case '7': case '8': case '9':
+		if (!expect_value) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("unexpected number"));
+		    goto bad;
+		}
+		/* XXX - strtonumx() would be simpler here. */
+		len = strcspn(cp, " \f\n\r\t\v,");
+		ch = cp[len];
+		cp[len] = '\0';
+		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
+		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
+			U_("missing separator between values"));
+		    goto bad;
+		}
+		saw_comma = false;
+		num = sudo_strtonum(cp, LLONG_MIN, LLONG_MAX, &errstr);
+		if (errstr != NULL) {
+		    sudo_warnx("%s:%u:%td: %s: %s", filename, lineno, cp - buf,
+			cp, U_(errstr));
+		    goto bad;
+		}
+		cp += len;
+		*cp = ch;
+
+		if (!json_insert_num(&frame->items, name, num, lineno))
+		    goto bad;
+		name = NULL;
+		break;
+	    default:
+		goto parse_error;
+	    }
+	}
+    }
+    if (stack.depth != 0) {
+	frame = stack.frames[stack.depth - 1];
+	if (frame->parent == NULL || frame->parent->type == JSON_OBJECT) {
+	    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf,
+		U_("unmatched close brace"));
+	} else {
+	    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf,
+		U_("unmatched close bracket"));
+	}
+	goto bad;
+    }
+
+    goto done;
+
+parse_error:
+    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, U_("parse error"));
+bad:
+    eventlog_json_free(root);
+    root = NULL;
+done:
+    free(buf);
+    free(name);
+
+    debug_return_ptr(root);
+}
diff --git a/lib/iolog/iolog_json.h b/lib/eventlog/parse_json.h
similarity index 76%
rename from lib/iolog/iolog_json.h
rename to lib/eventlog/parse_json.h
index bc28dfa3e..5ab2142f6 100644
--- a/lib/iolog/iolog_json.h
+++ b/lib/eventlog/parse_json.h
@@ -1,7 +1,7 @@
 /*
  * SPDX-License-Identifier: ISC
  *
- * Copyright (c) 2020 Todd C. Miller <Todd.Miller@sudo.ws>
+ * Copyright (c) 2020, 2023 Todd C. Miller <Todd.Miller@sudo.ws>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,15 +16,15 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef IOLOG_JSON_H
-#define IOLOG_JSON_H
+#ifndef PARSE_JSON_H
+#define PARSE_JSON_H
 
 #include "sudo_json.h"
 #include "sudo_queue.h"
 
 TAILQ_HEAD(json_item_list, json_item);
 
-struct json_object {
+struct eventlog_json_object {
     struct json_item *parent;
     struct json_item_list items;
 };
@@ -35,7 +35,7 @@ struct json_item {
     unsigned int lineno;
     enum json_value_type type;
     union {
-	struct json_object child;
+	struct eventlog_json_object child;
 	char *string;
 	long long number;
 	id_t id;
@@ -43,8 +43,4 @@ struct json_item {
     } u;
 };
 
-void free_json_items(struct json_item_list *items);
-bool iolog_parse_json(FILE *fp, const char *filename, struct json_object *root);
-char **json_array_to_strvec(struct json_object *array);
-
-#endif /* IOLOG_JSON_H */
+#endif /* PARSE_JSON_H */
diff --git a/lib/iolog/regress/iolog_json/check_iolog_json.c b/lib/eventlog/regress/parse_json/check_parse_json.c
similarity index 93%
rename from lib/iolog/regress/iolog_json/check_iolog_json.c
rename to lib/eventlog/regress/parse_json/check_parse_json.c
index ce8565fcc..ac80cf808 100644
--- a/lib/iolog/regress/iolog_json/check_iolog_json.c
+++ b/lib/eventlog/regress/parse_json/check_parse_json.c
@@ -27,15 +27,16 @@
 #define SUDO_ERROR_WRAP 0
 
 #include "sudo_compat.h"
-#include "sudo_util.h"
+#include "sudo_eventlog.h"
 #include "sudo_fatal.h"
+#include "sudo_util.h"
 
-#include "iolog_json.h"
+#include "parse_json.h"
 
 sudo_dso_public int main(int argc, char *argv[]);
 
 static bool
-json_print_object(struct json_container *jsonc, struct json_object *object)
+json_print_object(struct json_container *jsonc, struct eventlog_json_object *object)
 {
     struct json_item *item;
     struct json_value json_value;
@@ -98,7 +99,7 @@ done:
 }
 
 static bool
-json_format(struct json_container *jsonc, struct json_object *object)
+json_format(struct json_container *jsonc, struct eventlog_json_object *object)
 {
     struct json_item *item;
     bool ret = false;
@@ -170,11 +171,10 @@ compare(FILE *fp, const char *infile, struct json_container *jsonc)
 int
 main(int argc, char *argv[])
 {
-    struct json_object root;
     int ch, i, ntests = 0, errors = 0;
     bool cat = false;
 
-    initprogname(argc > 0 ? argv[0] : "check_iolog_json");
+    initprogname(argc > 0 ? argv[0] : "check_parse_json");
 
     while ((ch = getopt(argc, argv, "c")) != -1) {
 	switch (ch) {
@@ -192,6 +192,7 @@ main(int argc, char *argv[])
 	usage();
 
     for (i = 0; i < argc; i++) {
+	struct eventlog_json_object *root;
 	struct json_container jsonc;
 	const char *infile = argv[i];
 	const char *outfile = argv[i];
@@ -213,13 +214,14 @@ main(int argc, char *argv[])
 	    errors++;
 	    continue;
 	}
-	if (!iolog_parse_json(infp, infile, &root)) {
+	root = eventlog_json_read(infp, infile);
+	if (root == NULL) {
 	    errors++;
 	    goto next;
 	}
 
 	/* Format as pretty-printed JSON */
-	if (!json_format(&jsonc, &root)) {
+	if (!json_format(&jsonc, root)) {
 	    errors++;
 	    goto next;
 	}
@@ -247,7 +249,7 @@ main(int argc, char *argv[])
 	}
 
 next:
-	free_json_items(&root.items);
+	eventlog_json_free(root);
 	sudo_json_free(&jsonc);
 	if (infp != NULL)
 	    fclose(infp);
diff --git a/lib/iolog/regress/iolog_json/test1.in b/lib/eventlog/regress/parse_json/test1.in
similarity index 100%
rename from lib/iolog/regress/iolog_json/test1.in
rename to lib/eventlog/regress/parse_json/test1.in
diff --git a/lib/iolog/regress/iolog_json/test2.in b/lib/eventlog/regress/parse_json/test2.in
similarity index 100%
rename from lib/iolog/regress/iolog_json/test2.in
rename to lib/eventlog/regress/parse_json/test2.in
diff --git a/lib/iolog/regress/iolog_json/test2.out.ok b/lib/eventlog/regress/parse_json/test2.out.ok
similarity index 100%
rename from lib/iolog/regress/iolog_json/test2.out.ok
rename to lib/eventlog/regress/parse_json/test2.out.ok
diff --git a/lib/iolog/regress/iolog_json/test3.in b/lib/eventlog/regress/parse_json/test3.in
similarity index 100%
rename from lib/iolog/regress/iolog_json/test3.in
rename to lib/eventlog/regress/parse_json/test3.in
diff --git a/lib/iolog/regress/iolog_json/test3.out.ok b/lib/eventlog/regress/parse_json/test3.out.ok
similarity index 100%
rename from lib/iolog/regress/iolog_json/test3.out.ok
rename to lib/eventlog/regress/parse_json/test3.out.ok
diff --git a/lib/iolog/Makefile.in b/lib/iolog/Makefile.in
index 61bc05815..b4f1e873e 100644
--- a/lib/iolog/Makefile.in
+++ b/lib/iolog/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2011-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2011-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -78,8 +78,8 @@ PVS_IGNORE = 'V707,V011,V002,V536'
 PVS_LOG_OPTS = -a 'GA:1,2' -e -t errorfile -d $(PVS_IGNORE)
 
 # Regression tests
-TEST_PROGS = check_iolog_filter check_iolog_json check_iolog_mkpath \
-	     check_iolog_path check_iolog_timing host_port_test
+TEST_PROGS = check_iolog_filter check_iolog_mkpath check_iolog_path \
+	     check_iolog_timing host_port_test
 TEST_LIBS = @LIBS@
 TEST_LDFLAGS = @LDFLAGS@
 TEST_VERBOSE =
@@ -123,8 +123,6 @@ CHECK_IOLOG_TIMING_OBJS = check_iolog_timing.lo
 
 CHECK_IOLOG_FILTER_OBJS = check_iolog_filter.lo
 
-CHECK_IOLOG_JSON_OBJS = check_iolog_json.lo
-
 HOST_PORT_TEST_OBJS = host_port_test.lo
 
 FUZZ_IOLOG_JSON_OBJS = fuzz_iolog_json.lo
@@ -175,9 +173,6 @@ check_iolog_timing: $(CHECK_IOLOG_TIMING_OBJS) libsudo_iolog.la
 check_iolog_filter: $(CHECK_IOLOG_FILTER_OBJS) libsudo_iolog.la
 	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(CHECK_IOLOG_FILTER_OBJS) libsudo_iolog.la $(ASAN_LDFLAGS) $(PIE_LDFLAGS) $(HARDENING_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
 
-check_iolog_json: $(CHECK_IOLOG_JSON_OBJS) libsudo_iolog.la
-	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(CHECK_IOLOG_JSON_OBJS) libsudo_iolog.la $(ASAN_LDFLAGS) $(PIE_LDFLAGS) $(HARDENING_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
-
 host_port_test: $(HOST_PORT_TEST_OBJS) libsudo_iolog.la
 	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(HOST_PORT_TEST_OBJS) libsudo_iolog.la $(ASAN_LDFLAGS) $(PIE_LDFLAGS) $(HARDENING_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
 
@@ -328,7 +323,6 @@ check: $(TEST_PROGS) check-fuzzer
 	    MALLOC_CONF="abort:true,junk:true"; export MALLOC_CONF; \
 	    rval=0; \
 	    ./check_iolog_filter $(srcdir)/regress/iolog_filter/test[1-9]* || rval=`expr $$rval + $$?`; \
-	    ./check_iolog_json $(srcdir)/regress/iolog_json/*.in || rval=`expr $$rval + $$?`; \
 	    ./check_iolog_path $(srcdir)/regress/iolog_path/data || rval=`expr $$rval + $$?`; \
 	    ./check_iolog_mkpath || rval=`expr $$rval + $$?`; \
 	    ./check_iolog_timing || rval=`expr $$rval + $$?`; \
@@ -377,22 +371,6 @@ check_iolog_filter.i: $(srcdir)/regress/iolog_filter/check_iolog_filter.c \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 check_iolog_filter.plog: check_iolog_filter.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/iolog_filter/check_iolog_filter.c --i-file $< --output-file $@
-check_iolog_json.lo: $(srcdir)/regress/iolog_json/check_iolog_json.c \
-                     $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
-                     $(incdir)/sudo_fatal.h $(incdir)/sudo_json.h \
-                     $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-                     $(incdir)/sudo_util.h $(srcdir)/iolog_json.h \
-                     $(top_builddir)/config.h
-	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/iolog_json/check_iolog_json.c
-check_iolog_json.i: $(srcdir)/regress/iolog_json/check_iolog_json.c \
-                     $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
-                     $(incdir)/sudo_fatal.h $(incdir)/sudo_json.h \
-                     $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
-                     $(incdir)/sudo_util.h $(srcdir)/iolog_json.h \
-                     $(top_builddir)/config.h
-	$(CC) -E -o $@ $(CPPFLAGS) $<
-check_iolog_json.plog: check_iolog_json.i
-	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/iolog_json/check_iolog_json.c --i-file $< --output-file $@
 check_iolog_mkpath.lo: $(srcdir)/regress/iolog_mkpath/check_iolog_mkpath.c \
                        $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
                        $(incdir)/sudo_fatal.h $(incdir)/sudo_iolog.h \
@@ -439,17 +417,15 @@ fuzz_iolog_json.lo: $(srcdir)/regress/fuzz/fuzz_iolog_json.c \
                     $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
                     $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \
                     $(incdir)/sudo_fatal.h $(incdir)/sudo_iolog.h \
-                    $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
-                    $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
-                    $(srcdir)/iolog_json.h $(top_builddir)/config.h
+                    $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                    $(incdir)/sudo_util.h $(top_builddir)/config.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/regress/fuzz/fuzz_iolog_json.c
 fuzz_iolog_json.i: $(srcdir)/regress/fuzz/fuzz_iolog_json.c \
                     $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
                     $(incdir)/sudo_debug.h $(incdir)/sudo_eventlog.h \
                     $(incdir)/sudo_fatal.h $(incdir)/sudo_iolog.h \
-                    $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
-                    $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
-                    $(srcdir)/iolog_json.h $(top_builddir)/config.h
+                    $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                    $(incdir)/sudo_util.h $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 fuzz_iolog_json.plog: fuzz_iolog_json.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/regress/fuzz/fuzz_iolog_json.c --i-file $< --output-file $@
@@ -617,19 +593,13 @@ iolog_gets.plog: iolog_gets.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/iolog_gets.c --i-file $< --output-file $@
 iolog_json.lo: $(srcdir)/iolog_json.c $(incdir)/compat/stdbool.h \
                $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
-               $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
-               $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
-               $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
-               $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
-               $(srcdir)/iolog_json.h $(top_builddir)/config.h
+               $(incdir)/sudo_eventlog.h $(incdir)/sudo_iolog.h \
+               $(incdir)/sudo_queue.h $(top_builddir)/config.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(HARDENING_CFLAGS) $(srcdir)/iolog_json.c
 iolog_json.i: $(srcdir)/iolog_json.c $(incdir)/compat/stdbool.h \
                $(incdir)/sudo_compat.h $(incdir)/sudo_debug.h \
-               $(incdir)/sudo_eventlog.h $(incdir)/sudo_fatal.h \
-               $(incdir)/sudo_gettext.h $(incdir)/sudo_iolog.h \
-               $(incdir)/sudo_json.h $(incdir)/sudo_plugin.h \
-               $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
-               $(srcdir)/iolog_json.h $(top_builddir)/config.h
+               $(incdir)/sudo_eventlog.h $(incdir)/sudo_iolog.h \
+               $(incdir)/sudo_queue.h $(top_builddir)/config.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 iolog_json.plog: iolog_json.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/iolog_json.c --i-file $< --output-file $@
diff --git a/lib/iolog/iolog_json.c b/lib/iolog/iolog_json.c
index 6f384ea59..d3d3bef0e 100644
--- a/lib/iolog/iolog_json.c
+++ b/lib/iolog/iolog_json.c
@@ -1,7 +1,7 @@
 /*
  * SPDX-License-Identifier: ISC
  *
- * Copyright (c) 2020-2021 Todd C. Miller <Todd.Miller@sudo.ws>
+ * Copyright (c) 2020-2023 Todd C. Miller <Todd.Miller@sudo.ws>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -30,908 +30,26 @@
 #else
 # include "compat/stdbool.h"
 #endif /* HAVE_STDBOOL_H */
-#include <string.h>
-#include <unistd.h>
-#include <ctype.h>
-#include <limits.h>
-#include <fcntl.h>
-#include <time.h>
 
 #include "sudo_compat.h"
 #include "sudo_debug.h"
 #include "sudo_eventlog.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
 #include "sudo_iolog.h"
-#include "sudo_util.h"
-
-#include "iolog_json.h"
-
-struct json_stack {
-    unsigned int depth;
-    unsigned int maxdepth;
-    struct json_object *frames[64];
-};
-#define JSON_STACK_INTIALIZER(s) { 0, nitems((s).frames) };
-
-static bool
-json_store_columns(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_columns, SUDO_DEBUG_UTIL);
-
-    if (item->u.number < 1 || item->u.number > INT_MAX) {
-	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
-	    "tty cols %lld: out of range", item->u.number);
-	evlog->columns = 0;
-	debug_return_bool(false);
-    }
-
-    evlog->columns = item->u.number;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_command(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_command, SUDO_DEBUG_UTIL);
-
-    /*
-     * Note: struct eventlog must store command + args.
-     *       We don't have argv yet so we append the args later.
-     */
-    free(evlog->command);
-    evlog->command = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_dumped_core(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_dumped_core, SUDO_DEBUG_UTIL);
-
-    evlog->dumped_core = item->u.boolean;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_exit_value(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_exit_value, SUDO_DEBUG_UTIL);
-
-    if (item->u.number < 0 || item->u.number > INT_MAX) {
-	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
-	    "exit value %lld: out of range", item->u.number);
-	evlog->exit_value = -1;
-	debug_return_bool(false);
-    }
-
-    evlog->exit_value = item->u.number;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_lines(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_lines, SUDO_DEBUG_UTIL);
-
-    if (item->u.number < 1 || item->u.number > INT_MAX) {
-	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
-	    "tty lines %lld: out of range", item->u.number);
-	evlog->lines = 0;
-	debug_return_bool(false);
-    }
-
-    evlog->lines = item->u.number;
-    debug_return_bool(true);
-}
-
-char **
-json_array_to_strvec(struct json_object *array)
-{
-    struct json_item *item;
-    int len = 0;
-    char **ret;
-    debug_decl(json_array_to_strvec, SUDO_DEBUG_UTIL);
-
-    TAILQ_FOREACH(item, &array->items, entries) {
-	/* Can only convert arrays of string. */
-	if (item->type != JSON_STRING) {
-	    sudo_warnx(U_("expected JSON_STRING, got %d"), item->type);
-	    debug_return_ptr(NULL);
-	}
-	/* Prevent integer overflow. */
-	if (++len == INT_MAX) {
-	    sudo_warnx("%s", U_("JSON_ARRAY too large"));
-	    debug_return_ptr(NULL);
-	}
-    }
-    if ((ret = reallocarray(NULL, len + 1, sizeof(char *))) == NULL) {
-	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
-	debug_return_ptr(NULL);
-    }
-    len = 0;
-    TAILQ_FOREACH(item, &array->items, entries) {
-	ret[len++] = item->u.string;
-	item->u.string = NULL;
-    }
-    ret[len] = NULL;
-
-    debug_return_ptr(ret);
-}
-
-static bool
-json_store_runargv(struct json_item *item, struct eventlog *evlog)
-{
-    int i;
-    debug_decl(json_store_runargv, SUDO_DEBUG_UTIL);
-
-    if (evlog->argv != NULL) {
-	for (i = 0; evlog->argv[i] != NULL; i++)
-	    free(evlog->argv[i]);
-	free(evlog->argv);
-    }
-    evlog->argv = json_array_to_strvec(&item->u.child);
-
-    debug_return_bool(evlog->argv != NULL);
-}
-
-static bool
-json_store_runenv(struct json_item *item, struct eventlog *evlog)
-{
-    int i;
-    debug_decl(json_store_runenv, SUDO_DEBUG_UTIL);
-
-    if (evlog->envp != NULL) {
-	for (i = 0; evlog->envp[i] != NULL; i++)
-	    free(evlog->envp[i]);
-	free(evlog->envp);
-    }
-    evlog->envp = json_array_to_strvec(&item->u.child);
-
-    debug_return_bool(evlog->envp != NULL);
-}
-
-static bool
-json_store_rungid(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_rungid, SUDO_DEBUG_UTIL);
-
-    evlog->rungid = (gid_t)item->u.number;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_rungroup(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_rungroup, SUDO_DEBUG_UTIL);
-
-    free(evlog->rungroup);
-    evlog->rungroup = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_runuid(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_runuid, SUDO_DEBUG_UTIL);
-
-    evlog->runuid = (uid_t)item->u.number;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_runuser(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_runuser, SUDO_DEBUG_UTIL);
-
-    free(evlog->runuser);
-    evlog->runuser = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_runchroot(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_runchroot, SUDO_DEBUG_UTIL);
-
-    free(evlog->runchroot);
-    evlog->runchroot = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_runcwd(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_runcwd, SUDO_DEBUG_UTIL);
-
-    free(evlog->runcwd);
-    evlog->runcwd = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_signal(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_signal, SUDO_DEBUG_UTIL);
-
-    free(evlog->signal_name);
-    evlog->signal_name = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_submitcwd(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_submitcwd, SUDO_DEBUG_UTIL);
-
-    free(evlog->cwd);
-    evlog->cwd = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_submithost(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_submithost, SUDO_DEBUG_UTIL);
-
-    free(evlog->submithost);
-    evlog->submithost = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_submituser(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_submituser, SUDO_DEBUG_UTIL);
-
-    free(evlog->submituser);
-    evlog->submituser = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static bool
-json_store_timespec(struct json_item *item, struct timespec *ts)
-{
-    struct json_object *object;
-    debug_decl(json_store_timespec, SUDO_DEBUG_UTIL);
-
-    object = &item->u.child;
-    TAILQ_FOREACH(item, &object->items, entries) {
-	if (item->type != JSON_NUMBER)
-	    continue;
-	if (strcmp(item->name, "seconds") == 0) {
-	    ts->tv_sec = item->u.number;
-	    continue;
-	}
-	if (strcmp(item->name, "nanoseconds") == 0) {
-	    ts->tv_nsec = item->u.number;
-	    continue;
-	}
-    }
-    debug_return_bool(true);
-}
-
-static bool
-json_store_run_time(struct json_item *item, struct eventlog *evlog)
-{
-    return json_store_timespec(item, &evlog->run_time);
-}
-
-static bool
-json_store_timestamp(struct json_item *item, struct eventlog *evlog)
-{
-    return json_store_timespec(item, &evlog->submit_time);
-}
-
-static bool
-json_store_ttyname(struct json_item *item, struct eventlog *evlog)
-{
-    debug_decl(json_store_ttyname, SUDO_DEBUG_UTIL);
-
-    free(evlog->ttyname);
-    evlog->ttyname = item->u.string;
-    item->u.string = NULL;
-    debug_return_bool(true);
-}
-
-static struct iolog_json_key {
-    const char *name;
-    enum json_value_type type;
-    bool (*setter)(struct json_item *, struct eventlog *);
-} iolog_json_keys[] = {
-    { "columns", JSON_NUMBER, json_store_columns },
-    { "command", JSON_STRING, json_store_command },
-    { "dumped_core", JSON_BOOL, json_store_dumped_core },
-    { "exit_value", JSON_NUMBER, json_store_exit_value },
-    { "lines", JSON_NUMBER, json_store_lines },
-    { "run_time", JSON_OBJECT, json_store_run_time },
-    { "runargv", JSON_ARRAY, json_store_runargv },
-    { "runenv", JSON_ARRAY, json_store_runenv },
-    { "rungid", JSON_ID, json_store_rungid },
-    { "rungroup", JSON_STRING, json_store_rungroup },
-    { "runuid", JSON_ID, json_store_runuid },
-    { "runuser", JSON_STRING, json_store_runuser },
-    { "runchroot", JSON_STRING, json_store_runchroot },
-    { "runcwd", JSON_STRING, json_store_runcwd },
-    { "signal", JSON_STRING, json_store_signal },
-    { "submitcwd", JSON_STRING, json_store_submitcwd },
-    { "submithost", JSON_STRING, json_store_submithost },
-    { "submituser", JSON_STRING, json_store_submituser },
-    { "timestamp", JSON_OBJECT, json_store_timestamp },
-    { "ttyname", JSON_STRING, json_store_ttyname },
-    { NULL }
-};
-
-static struct json_item *
-new_json_item(enum json_value_type type, char *name, unsigned int lineno)
-{
-    struct json_item *item;
-    debug_decl(new_json_item, SUDO_DEBUG_UTIL);
-
-    if ((item = malloc(sizeof(*item))) == NULL)  {
-	sudo_warnx(U_("%s: %s"), __func__,
-	    U_("unable to allocate memory"));
-	debug_return_ptr(NULL);
-    }
-    item->name = name;
-    item->type = type;
-    item->lineno = lineno;
-
-    debug_return_ptr(item);
-}
-
-static char *
-json_parse_string(char **strp)
-{
-    char *dst, *end, *ret, *src = *strp + 1;
-    size_t len;
-    debug_decl(json_parse_string, SUDO_DEBUG_UTIL);
-
-    for (end = src; *end != '"' && *end != '\0'; end++) {
-	if (end[0] == '\\' && end[1] == '"')
-	    end++;
-    }
-    if (*end != '"') {
-	sudo_warnx("%s", U_("missing double quote in name"));
-	debug_return_str(NULL);
-    }
-    len = (size_t)(end - src);
-
-    /* Copy string, flattening escaped chars. */
-    dst = ret = malloc(len + 1);
-    if (dst == NULL) {
-	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
-	debug_return_str(NULL);
-    }
-    while (src < end) {
-	char ch = *src++;
-	if (ch == '\\') {
-	    switch (*src) {
-	    case 'b':
-		ch = '\b';
-		break;
-	    case 'f':
-		ch = '\f';
-		break;
-	    case 'n':
-		ch = '\n';
-		break;
-	    case 'r':
-		ch = '\r';
-		break;
-	    case 't':
-		ch = '\t';
-		break;
-	    case 'u':
-		/* Only currently handles 8-bit ASCII. */
-		if (src[1] == '0' && src[2] == '0') {
-		    ch = sudo_hexchar(&src[3]);
-		    if (ch != -1) {
-			src += 4;
-			break;
-		    }
-		}
-		/* Not in \u00XX format. */
-		FALLTHROUGH;
-	    case '"':
-	    case '\\':
-	    default:
-		/* Note: a bare \ at the end of a string will be removed. */
-		ch = *src;
-		break;
-	    }
-	    src++;
-	}
-	*dst++ = ch;
-    }
-    *dst = '\0';
-
-    /* Trim trailing whitespace. */
-    do {
-	end++;
-    } while (isspace((unsigned char)*end));
-    *strp = end;
-
-    debug_return_str(ret);
-}
-
-void
-free_json_items(struct json_item_list *items)
-{
-    struct json_item *item;
-    debug_decl(free_json_items, SUDO_DEBUG_UTIL);
-
-    while ((item = TAILQ_FIRST(items)) != NULL) {
-	TAILQ_REMOVE(items, item, entries);
-	switch (item->type) {
-	case JSON_STRING:
-	    free(item->u.string);
-	    break;
-	case JSON_ARRAY:
-	case JSON_OBJECT:
-	    free_json_items(&item->u.child.items);
-	    break;
-	case JSON_ID:
-	case JSON_NUMBER:
-	case JSON_BOOL:
-	case JSON_NULL:
-	    /* Nothing to free. */
-	    break;
-	default:
-	    sudo_warnx("%s: internal error, invalid JSON type %d",
-		__func__, item->type);
-	    break;
-	}
-	free(item->name);
-	free(item);
-    }
-
-    debug_return;
-}
-
-static bool
-iolog_parse_json_object(struct json_object *object, struct eventlog *evlog)
-{
-    struct json_item *item;
-    bool ret = false;
-    debug_decl(iolog_parse_json_object, SUDO_DEBUG_UTIL);
-
-    /* First object holds all the actual data. */
-    item = TAILQ_FIRST(&object->items);
-    if (item == NULL) {
-	sudo_warnx("%s", U_("missing JSON_OBJECT"));
-	goto done;
-    }
-    if (item->type != JSON_OBJECT) {
-	sudo_warnx(U_("expected JSON_OBJECT, got %d"), item->type);
-	goto done;
-    }
-    object = &item->u.child;
-
-    TAILQ_FOREACH(item, &object->items, entries) {
-	struct iolog_json_key *key;
-
-	/* expecting key:value pairs */
-	if (item->name == NULL) {
-	    sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
-		"%s: missing object name", __func__);
-	    goto done;
-	}
-
-	/* lookup name */
-	for (key = iolog_json_keys; key->name != NULL; key++) {
-	    if (strcmp(item->name, key->name) == 0)
-		break;
-	}
-	if (key->name == NULL) {
-	    sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
-		"%s: unknown key %s", __func__, item->name);
-	} else if (key->type != item->type &&
-		(key->type != JSON_ID || item->type != JSON_NUMBER)) {
-	    sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
-		"%s: key mismatch %s type %d, expected %d", __func__,
-		item->name, item->type, key->type);
-	    goto done;
-	} else {
-	    /* Matched name and type. */
-	    if (!key->setter(item, evlog)) {
-		sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
-		    "unable to store %s", key->name);
-		goto done;
-	    }
-	}
-    }
-
-    ret = true;
-
-done:
-    debug_return_bool(ret);
-}
-
-static bool
-json_insert_bool(struct json_item_list *items, char *name, bool value,
-    unsigned int lineno)
-{
-    struct json_item *item;
-    debug_decl(json_insert_bool, SUDO_DEBUG_UTIL);
-
-    if ((item = new_json_item(JSON_BOOL, name, lineno)) == NULL)
-	debug_return_bool(false);
-    item->u.boolean = value;
-    TAILQ_INSERT_TAIL(items, item, entries);
-
-    debug_return_bool(true);
-}
-
-static bool
-json_insert_null(struct json_item_list *items, char *name, unsigned int lineno)
-{
-    struct json_item *item;
-    debug_decl(json_insert_null, SUDO_DEBUG_UTIL);
-
-    if ((item = new_json_item(JSON_NULL, name, lineno)) == NULL)
-	debug_return_bool(false);
-    TAILQ_INSERT_TAIL(items, item, entries);
-
-    debug_return_bool(true);
-}
-
-static bool
-json_insert_num(struct json_item_list *items, char *name, long long value,
-    unsigned int lineno)
-{
-    struct json_item *item;
-    debug_decl(json_insert_num, SUDO_DEBUG_UTIL);
-
-    if ((item = new_json_item(JSON_NUMBER, name, lineno)) == NULL)
-	debug_return_bool(false);
-    item->u.number = value;
-    TAILQ_INSERT_TAIL(items, item, entries);
-
-    debug_return_bool(true);
-}
-
-static bool
-json_insert_str(struct json_item_list *items, char *name, char **strp,
-    unsigned int lineno)
-{
-    struct json_item *item;
-    debug_decl(json_insert_str, SUDO_DEBUG_UTIL);
-
-    if ((item = new_json_item(JSON_STRING, name, lineno)) == NULL)
-	debug_return_bool(false);
-    item->u.string = json_parse_string(strp);
-    if (item->u.string == NULL) {
-	free(item);
-	debug_return_bool(false);
-    }
-    TAILQ_INSERT_TAIL(items, item, entries);
-
-    debug_return_bool(true);
-}
-
-static struct json_object *
-json_stack_push(struct json_stack *stack, struct json_item_list *items,
-    struct json_object *frame, enum json_value_type type, char *name,
-    unsigned int lineno)
-{
-    struct json_item *item;
-    debug_decl(json_stack_push, SUDO_DEBUG_UTIL);
-
-    /* We limit the stack size rather than expanding it. */
-    if (stack->depth >= stack->maxdepth) {
-	sudo_warnx(U_("json stack exhausted (max %u frames)"), stack->maxdepth);
-	debug_return_ptr(NULL);
-    }
-
-    /* Allocate a new item and insert it into the list. */
-    if ((item = new_json_item(type, name, lineno)) == NULL)
-	debug_return_ptr(NULL);
-    TAILQ_INIT(&item->u.child.items);
-    item->u.child.parent = item;
-    TAILQ_INSERT_TAIL(items, item, entries);
-
-    /* Push the current frame onto the stack (depth check performed above). */
-    stack->frames[stack->depth++] = frame;
-
-    /* Return the new frame */
-    debug_return_ptr(&item->u.child);
-}
-
-/* Only expect a value if a name is defined or we are in an array. */
-#define expect_value (name != NULL || (frame->parent != NULL && frame->parent->type == JSON_ARRAY))
-
-bool
-iolog_parse_json(FILE *fp, const char *filename, struct json_object *root)
-{
-    struct json_object *frame = root;
-    struct json_stack stack = JSON_STACK_INTIALIZER(stack);
-    unsigned int lineno = 0;
-    char *name = NULL;
-    char *cp, *buf = NULL;
-    size_t bufsize = 0;
-    ssize_t len;
-    bool ret = false;
-    bool saw_comma = false;
-    long long num;
-    char ch;
-    debug_decl(iolog_parse_json, SUDO_DEBUG_UTIL);
-
-    root->parent = NULL;
-    TAILQ_INIT(&root->items);
-
-    while ((len = getdelim(&buf, &bufsize, '\n', fp)) != -1) {
-	char *ep = buf + len - 1;
-	cp = buf;
-
-	lineno++;
-
-	/* Trim trailing whitespace. */
-	while (ep > cp && isspace((unsigned char)*ep))
-	    ep--;
-	ep[1] = '\0';
-
-	for (;;) {
-	    const char *errstr;
-
-	    /* Trim leading whitespace, skip blank lines. */
-	    while (isspace((unsigned char)*cp))
-		cp++;
-
-	    /* Check for comma separator and strip it out. */
-	    if (*cp == ',') {
-		saw_comma = true;
-		cp++;
-		while (isspace((unsigned char)*cp))
-		    cp++;
-	    }
-
-	    /* End of line? */
-	    if (*cp == '\0')
-		break;
-
-	    switch (*cp) {
-	    case '{':
-		if (name == NULL && frame->parent != NULL) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("objects must consist of name:value pairs"));
-		    goto done;
-		}
-		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("missing separator between values"));
-		    goto done;
-		}
-		cp++;
-		saw_comma = false;
-		frame = json_stack_push(&stack, &frame->items, frame,
-		    JSON_OBJECT, name, lineno);
-		if (frame == NULL)
-		    goto done;
-		name = NULL;
-		break;
-	    case '}':
-		if (stack.depth == 0 || frame->parent == NULL ||
-			frame->parent->type != JSON_OBJECT) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unmatched close brace"));
-		    goto done;
-		}
-		cp++;
-		frame = stack.frames[--stack.depth];
-		saw_comma = false;
-		break;
-	    case '[':
-		if (frame->parent == NULL) {
-		    /* Must have an enclosing object. */
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unexpected array"));
-		    goto done;
-		}
-		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("missing separator between values"));
-		    goto done;
-		}
-		cp++;
-		saw_comma = false;
-		frame = json_stack_push(&stack, &frame->items, frame,
-		    JSON_ARRAY, name, lineno);
-		if (frame == NULL)
-		    goto done;
-		name = NULL;
-		break;
-	    case ']':
-		if (stack.depth == 0 || frame->parent == NULL ||
-			frame->parent->type != JSON_ARRAY) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unmatched close bracket"));
-		    goto done;
-		}
-		cp++;
-		frame = stack.frames[--stack.depth];
-		saw_comma = false;
-		break;
-	    case '"':
-		if (frame->parent == NULL) {
-		    /* Must have an enclosing object. */
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unexpected string"));
-		    goto done;
-		}
-
-		if (!expect_value) {
-		    /* Parse "name": */
-		    if ((name = json_parse_string(&cp)) == NULL)
-			goto done;
-		    /* TODO: allow colon on next line? */
-		    if (*cp != ':') {
-			sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			    U_("missing colon after name"));
-			goto done;
-		    }
-		    cp++;
-		} else {
-		    if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-			sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			    U_("missing separator between values"));
-			goto done;
-		    }
-		    saw_comma = false;
-		    if (!json_insert_str(&frame->items, name, &cp, lineno))
-			goto done;
-		    name = NULL;
-		}
-		break;
-	    case 't':
-		if (strncmp(cp, "true", sizeof("true") - 1) != 0)
-		    goto parse_error;
-		if (!expect_value) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unexpected boolean"));
-		    goto done;
-		}
-		cp += sizeof("true") - 1;
-		if (*cp != ',' && !isspace((unsigned char)*cp) && *cp != '\0')
-		    goto parse_error;
-		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("missing separator between values"));
-		    goto done;
-		}
-		saw_comma = false;
-
-		if (!json_insert_bool(&frame->items, name, true, lineno))
-		    goto done;
-		name = NULL;
-		break;
-	    case 'f':
-		if (strncmp(cp, "false", sizeof("false") - 1) != 0)
-		    goto parse_error;
-		if (!expect_value) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unexpected boolean"));
-		    goto done;
-		}
-		cp += sizeof("false") - 1;
-		if (*cp != ',' && !isspace((unsigned char)*cp) && *cp != '\0')
-		    goto parse_error;
-		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("missing separator between values"));
-		    goto done;
-		}
-		saw_comma = false;
-
-		if (!json_insert_bool(&frame->items, name, false, lineno))
-		    goto done;
-		name = NULL;
-		break;
-	    case 'n':
-		if (strncmp(cp, "null", sizeof("null") - 1) != 0)
-		    goto parse_error;
-		if (!expect_value) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unexpected null"));
-		    goto done;
-		}
-		cp += sizeof("null") - 1;
-		if (*cp != ',' && !isspace((unsigned char)*cp) && *cp != '\0')
-		    goto parse_error;
-		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("missing separator between values"));
-		    goto done;
-		}
-		saw_comma = false;
-
-		if (!json_insert_null(&frame->items, name, lineno))
-		    goto done;
-		name = NULL;
-		break;
-	    case '+': case '-': case '0': case '1': case '2': case '3':
-	    case '4': case '5': case '6': case '7': case '8': case '9':
-		if (!expect_value) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("unexpected number"));
-		    goto done;
-		}
-		/* XXX - strtonumx() would be simpler here. */
-		len = strcspn(cp, " \f\n\r\t\v,");
-		ch = cp[len];
-		cp[len] = '\0';
-		if (!saw_comma && !TAILQ_EMPTY(&frame->items)) {
-		    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, 
-			U_("missing separator between values"));
-		    goto done;
-		}
-		saw_comma = false;
-		num = sudo_strtonum(cp, LLONG_MIN, LLONG_MAX, &errstr);
-		if (errstr != NULL) {
-		    sudo_warnx("%s:%u:%td: %s: %s", filename, lineno, cp - buf,
-			cp, U_(errstr));
-		    goto done;
-		}
-		cp += len;
-		*cp = ch;
-
-		if (!json_insert_num(&frame->items, name, num, lineno))
-		    goto done;
-		name = NULL;
-		break;
-	    default:
-		goto parse_error;
-	    }
-	}
-    }
-    if (stack.depth != 0) {
-	frame = stack.frames[stack.depth - 1];
-	if (frame->parent == NULL || frame->parent->type == JSON_OBJECT) {
-	    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf,
-		U_("unmatched close brace"));
-	} else {
-	    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf,
-		U_("unmatched close bracket"));
-	}
-	goto done;
-    }
-
-    ret = true;
-    goto done;
-
-parse_error:
-    sudo_warnx("%s:%u:%td: %s", filename, lineno, cp - buf, U_("parse error"));
-done:
-    free(buf);
-    free(name);
-    if (!ret)
-	free_json_items(&root->items);
-
-    debug_return_bool(ret);
-}
 
 bool
 iolog_parse_loginfo_json(FILE *fp, const char *iolog_dir, struct eventlog *evlog)
 {
-    struct json_object root;
+    struct eventlog_json_object *root;
     bool ret = false;
     debug_decl(iolog_parse_loginfo_json, SUDO_DEBUG_UTIL);
 
-    if (iolog_parse_json(fp, iolog_dir, &root)) {
-	/* Walk the stack and parse entries. */
-	ret = iolog_parse_json_object(&root, evlog);
+    root = eventlog_json_read(fp, iolog_dir);
+    if (root != NULL) {
+	/* Parse the JSON into an eventlog. */
+	ret = eventlog_json_parse(root, evlog);
 
 	/* Cleanup. */
-	free_json_items(&root.items);
+	eventlog_json_free(root);
     }
 
     debug_return_bool(ret);
diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_json.c b/lib/iolog/regress/fuzz/fuzz_iolog_json.c
index 80f6c9f66..ef12721d6 100644
--- a/lib/iolog/regress/fuzz/fuzz_iolog_json.c
+++ b/lib/iolog/regress/fuzz/fuzz_iolog_json.c
@@ -34,8 +34,6 @@
 #include "sudo_plugin.h"
 #include "sudo_util.h"
 
-#include "iolog_json.h"
-
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
 static FILE *