Mailing List Archive

template to fwd msg to journal with local variables
Hi,

I have rsyslog 8.38.0 listening on UDP port 514 and redirecting any
message to systemd journal.

There are some caveats to this solution: e.g. I cannot modify journal's
hostname and app - these are 'reserved' system variables by journal. But
I can live with that limitation.

This config works by sending the whole raw message.

module(load="imudp") # input module for UDP syslog
module(load="omjournal") # output module for journal

$PreserveFQDN on

input(type="imudp" port="514" ruleset="writeToJournal")

template(name="journal" type="list") {
property(name="rawmsg-after-pri" outname="MESSAGE")
property(name="syslogseverity" outname="PRIORITY")
property(name="syslogfacility" outname="SYSLOG_FACILITY")
}

ruleset(name="writeToJournal") {
action(type="omjournal" template="journal")
}

However, the property rawmsg-after-pri includes also datetime stamp,
which is redundant.

Dec 30 11:34:01 server rsyslogd[3668]: DEC 30 11:34:01 router prefix:
dhcp1 assigned 10.11.13.103 to AA:BB:CC:DD:EE:FF

Is there a way how to construct own property? The only requirement of
output plugin omjournal seems that the template is of type 'list' and
that outname is 'MESSAGE'.

I tried the following, but no messages appear in journal:

module(load="imudp") # input module for UDP syslog
module(load="omjournal") # output module for journal
$PreserveFQDN on

input(type="imudp" port="514" ruleset="writeToJournal")

template(name="journal" type="list") {
property(name="$.journalfmt" outname="MESSAGE")
property(name="syslogseverity" outname="PRIORITY")
property(name="syslogfacility" outname="SYSLOG_FACILITY")
}

ruleset(name="writeToJournal") {
set $.journalfmt = "test";
action(type="omjournal" template="journal")
}

Once I get this working, I would like to eventually have a message
consisting of '$hostname $syslogtag $msg' - but it is not clear how to
concatenate strings into a local variable without any structure.

BR

Milan

--
Milan Knížek | knizek.confy@gmail.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.