omrelp rsyslog config

01-omrelp.conf

$ModLoad omrelp
$RepeatedMsgReduction off

$template ls_json,"{\"@version\":1,\"@timestamp\":\"%timestamp:1:19:date-rfc3339%.%timestamp:1:3:date-subseconds%+00:00\",%HOSTNAME:::jsonf:source_host%,\"message\":\"%timestamp% %app-name%:%msg:::json%\",%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%}"
*.* :omrelp:127.0.0.1:20514;ls_json

logstash.conf

input {
	relp { port => 20514 codec => "json" add_field => {"es_component" => "syslog"}}
        redis {
                data_type => "list"
                key => "logstash_plain"
        }
        redis {
                data_type => "list"
                key => "logstash_jsonevent"
                codec => "json"
	}

}
filter {
  if [source_host] =~ /\d+\.\d+\.\d+\.\d+/ { dns { action => "replace" reverse => [ "source_host"] } }
  if [source_host] =~ /[^.]+\..*/ { mutate { gsub => [ "source_host", "([^.]+)\..*", "\1" ] } }
}
output {
        #stdout { debug => true }
        elasticsearch_http { codec => "json" host => "localhost" }
}