rsyslog to Elasticsearch

elastic.conf

# monthly syslog indices
template(name="logstash-index"
  type="list") {
    constant(value="logstash-syslog-")
    property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
    constant(value=".")
    property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
}

# most data we can get
template(name="json-syslog"
  type="list"
  option.json="on") {
    constant(value="{")
      constant(value="\"@timestamp\"     :\"")   property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"sysloghost\"  :\"")   property(name="hostname")
      constant(value="\",\"severity\"    :\"")   property(name="syslogseverity-text")
      constant(value="\",\"facility\"    :\"")   property(name="syslogfacility-text")
      constant(value="\",\"raw_tag\"     :\"")   property(name="syslogtag")
      constant(value="\",\"program\"     :\"")   property(name="programname")
      constant(value="\",\"app\"         :\"")   property(name="app-name")
      constant(value="\",\"source\"      :\"")   property(name="inputname")
      constant(value="\",\"pid\"         :\"")   property(name="procid")
      constant(value="\",\"message\"     :\"")   property(name="msg")
      constant(value="\",\"raw_message\" :\"")   property(name="rawmsg")
      constant(value="\",\"type\"        :\"rsyslog")
    constant(value="\"}")
}

# send to ES
action(type="omelasticsearch"
    server="localhost"
    template="json-syslog"
    searchIndex="logstash-index"
    dynSearchIndex="on")

elastic.conf.erb

# monthly syslog indices
template(name="logstash-index"
  type="list") {
    constant(value="logstash-syslog-")
    property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
    constant(value=".")
    property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
}

# all the data that might be useful
template(name="json-syslog"
  type="list"
  option.json="on") {
    constant(value="{")
      constant(value="\"@timestamp\"     :\"")   property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"sysloghost\"  :\"")   property(name="hostname")
      constant(value="\",\"severity\"    :\"")   property(name="syslogseverity-text")
      constant(value="\",\"facility\"    :\"")   property(name="syslogfacility-text")
      constant(value="\",\"raw_tag\"     :\"")   property(name="syslogtag")
      constant(value="\",\"program\"     :\"")   property(name="programname")
      constant(value="\",\"app\"         :\"")   property(name="app-name")
      constant(value="\",\"source\"      :\"")   property(name="inputname")
      constant(value="\",\"pid\"         :\"")   property(name="procid")
      constant(value="\",\"message\"     :\"")   property(name="msg")
      constant(value="\",\"raw_message\" :\"")   property(name="rawmsg")
      constant(value="\",\"hostname\"    :\"<%= @fqdn %>")
      constant(value="\",\"type\"        :\"rsyslog")
    constant(value="\"}")
}

# send to ES
action(             type="omelasticsearch"
                  server="<%= @logserver %>"
                template="json-syslog"
             searchIndex="logstash-index"
          dynSearchIndex="on"
                bulkmode="on"
              queue.type="linkedlist"
              queue.size="5000"
  queue.dequeuebatchsize="30"
 action.resumeretrycount="-1")