syslog-ng SDATA RFC5424

syslog-ng-receiver.conf

source s_remote_udp {
  network(
    transport(udp),
    port(514),
    flags(syslog-protocol)
  );
};

filter f_dell {
  match(
    '^PowerEdge',
    value(".SDATA.facter.productname")
  );
};

destination d_dell {
  file("/var/log/remote/dell.log");
};

log {
  source(s_remote_udp);
  filter(f_dell);
  destination(d_dell);
};

syslog-ng-sender.conf

rewrite r_sdata_facter {
  set(
      "PowerEdge 1950",
      value(
        ".SDATA.facter.productname"
      )
  );
};

destination d_network {
  network(
    "remote-syslog",
    transport(udp),
    port(514),
    flags(syslog-protocol)
  );
};

log {
  ...
  rewrite(r_sdata_facter);
  destination(d_network);
};