rsyslog_templates.conf

#
# Templates
#

# Some useful templates for shipping
# The role field refers to the machines role.

# Template for shipping syslog rfc5424 messages sent directly to rsyslog.
# Ships in JSON
template(name="syslogTemplate"
   type="list") {
   constant(value="{ ")
   constant(value="\"type\":\"syslog\", ")
   constant(value="\"host\":\"")
   property(name="hostname")
   constant(value="\", ")
   constant(value="\"timestamp\":\"")
   property(name="timestamp" dateFormat="rfc3339")
   constant(value="\", ")
   constant(value="\"@version\":\"1\", ")
   constant(value="\"role\":\"awesome_app\", ")
   constant(value="\"message\":\"")
   property(name="msg" format="json")
   constant(value="\", ")
   constant(value="\"priority\":\"")
   property(name="syslogseverity")
   constant(value="\", ")
   constant(value="\"program\":\"")
   property(name="programname")
   constant(value="\", ")
   constant(value="\"facility\":\"")
   property(name="syslogfacility-text")
   constant(value="\", ")
   constant(value="\"severity\":\"")
   property(name="syslogseverity-text")
   constant(value="\"}\n")
}

# Template for shipping JSON logs
# Just adds some furniture to the json message
template(name="jsonLogTemplate"
   type="list") {
   constant(value="{ ")
   constant(value="\"type\":\"")
   property(name="programname")
   constant(value="\", ")
   constant(value="\"host\":\"")
   property(name="hostname")
   constant(value="\", ")
   constant(value="\"@version\":\"1\", ")
   constant(value="\"role\":\"awesome_app\", ")
   constant(value="\"sourcefile\":\"")
   property(name="$!metadata!filename")
   constant(value="\", ")
   property(name="msg" position.from="2")
   constant(value="\n")
}

# Template for non json logs, just sends the message wholesale with extra
# furniture. 
template(name="textLogTemplate"
   type="list") {
   constant(value="{ ")
   constant(value="\"type\":\"")
   property(name="programname")
   constant(value="\", ")
   constant(value="\"host\":\"")
   property(name="hostname")
   constant(value="\", ")
   constant(value="\"timestamp\":\"")
   property(name="timestamp" dateFormat="rfc3339")
   constant(value="\", ")
   constant(value="\"@version\":\"1\", ")
   constant(value="\"role\":\"awesome_app\", ")
   constant(value="\"sourcefile\":\"")
   property(name="$!metadata!filename")
   constant(value="\", ")
   constant(value="\"message\":\"")
   property(name="rawmsg" format="json")
   constant(value="\"}\n")
}