rsyslog.conf

module(load="imuxsock" SysSock.Use="on")
module(load="omhiredis")

input (type="imuxsock" Socket="/dev/log")


template(name="plain-syslog"
  type="list") {
    constant(value="{")
      constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"host\":\"")        property(name="hostname")
      constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")
      constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")
      constant(value="\",\"tag\":\"")   property(name="syslogtag" format="json")
      constant(value="\",\"@message\":\"")    property(name="msg" format="json")
    constant(value="\"}")
}

action(
    action.resumeretrycount="-1"
    action.resumeinterval="5"
    queue.spoolDirectory="/var/spool/rsyslog"
    queue.maxDiskSpace="1G"
    queue.filename="rsyslog-redis-queue" 
    queue.size="1000000" 
    queue.type="LinkedList"
    type="omhiredis"
    mode="queue"
    key="rsyslog"
    server="localhost"
    template="plain-syslog"
)

zsh history

# Note that I *save* redis before stopping it, because otherwise I'll lose messages 1-3.
# That's down to redis storing things transiently, though.

bob@made-lt051:~|⇒  docker run -d -p 6379:6379 --name rsyslog_redis redis
bob@made-lt051:~|⇒  logger -t test 1
bob@made-lt051:~|⇒  logger -t test 2
bob@made-lt051:~|⇒  logger -t test 3
bob@made-lt051:~|⇒  redis-cli
127.0.0.1:6379> save
OK
127.0.0.1:6379> 
bob@made-lt051:~|⇒  docker stop rsyslog_redis
rsyslog_redis
bob@made-lt051:~|⇒  logger -t test 4         
bob@made-lt051:~|⇒  logger -t test 5
bob@made-lt051:~|⇒  logger -t test 6
bob@made-lt051:~|⇒  logger -t test 7 
bob@made-lt051:~|⇒  docker restart rsyslog_redis
rsyslog_redis
bob@made-lt051:~|⇒  logger -t test 8            
bob@made-lt051:~|⇒  logger -t test 9
bob@made-lt051:~|⇒  logger -t test 10
bob@made-lt051:~|⇒  redis-cli
127.0.0.1:6379> LRANGE rsyslog 0 -1
 1) "{\"@timestamp\":\"2016-08-23T07:40:32.765225+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 10\"}"
 2) "{\"@timestamp\":\"2016-08-23T07:40:30.489225+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 9\"}"
 3) "{\"@timestamp\":\"2016-08-23T07:40:28.676681+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 8\"}"
 4) "{\"@timestamp\":\"2016-08-23T07:40:27.706366+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
 5) "{\"@timestamp\":\"2016-08-23T07:40:27.706320+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
 6) "{\"@timestamp\":\"2016-08-23T07:40:27.704384+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
 7) "{\"@timestamp\":\"2016-08-23T07:40:27.704335+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
 8) "{\"@timestamp\":\"2016-08-23T07:40:22.699173+01:00\",\"host\":\"localhost\",\"severity\":\"err\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2007:\",\"@message\":\"can not initialize redis handle [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2007 ]\"}"
 9) "{\"@timestamp\":\"2016-08-23T07:40:22.697221+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
10) "{\"@timestamp\":\"2016-08-23T07:40:22.697168+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
11) "{\"@timestamp\":\"2016-08-23T07:40:17.692474+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 7\"}"
12) "{\"@timestamp\":\"2016-08-23T07:40:17.692084+01:00\",\"host\":\"localhost\",\"severity\":\"err\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2007:\",\"@message\":\"can not initialize redis handle [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2007 ]\"}"
13) "{\"@timestamp\":\"2016-08-23T07:40:17.688683+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
14) "{\"@timestamp\":\"2016-08-23T07:40:17.688639+01:00\",\"host\":\"localhost\",\"severity\":\"info\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2359:\",\"@message\":\"action 'action 0' resumed (module 'omhiredis') [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2359 ]\"}"
15) "{\"@timestamp\":\"2016-08-23T07:40:15.405405+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 6\"}"
16) "{\"@timestamp\":\"2016-08-23T07:40:14.375120+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 5\"}"
17) "{\"@timestamp\":\"2016-08-23T07:40:12.683522+01:00\",\"host\":\"localhost\",\"severity\":\"err\",\"facility\":\"syslog\",\"tag\":\"rsyslogd-2007:\",\"@message\":\"can not initialize redis handle [v8.21.0.master try http:\\/\\/www.rsyslog.com\\/e\\/2007 ]\"}"
18) "{\"@timestamp\":\"2016-08-23T07:40:12.681325+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 4\"}"
19) "{\"@timestamp\":\"2016-08-23T07:39:12.688229+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 3\"}"
20) "{\"@timestamp\":\"2016-08-23T07:39:10.346909+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 2\"}"
21) "{\"@timestamp\":\"2016-08-23T07:39:07.548658+01:00\",\"host\":\"localhost\",\"severity\":\"notice\",\"facility\":\"user\",\"tag\":\"test:\",\"@message\":\" 1\"}"