JSON rsyslog output for Logstash
template(name="ls_json" | |
type="list" | |
option.json="on") { | |
constant(value="{") | |
constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339") | |
constant(value="\",\"@version\":\"1") | |
constant(value="\",\"message\":\"") property(name="msg") | |
constant(value="\",\"host\":\"") property(name="hostname") | |
constant(value="\",\"severity\":\"") property(name="syslogseverity-text") | |
constant(value="\",\"facility\":\"") property(name="syslogfacility-text") | |
constant(value="\",\"programname\":\"") property(name="programname") | |
constant(value="\",\"procid\":\"") property(name="procid") | |
constant(value="\"}\n") | |
} |
input { | |
udp { | |
port => 10514 | |
codec => "json" | |
type => "syslog" | |
} | |
} | |
filter { | |
# This replaces the host field (UDP source) with the host that generated the message (sysloghost) | |
if [sysloghost] { | |
mutate { | |
replace => [ "host", "%{sysloghost}" ] | |
remove_field => "sysloghost" # prune the field after successfully replacing "host" | |
} | |
} | |
} | |
output { | |
# whatever | |
} |
# Other config goes above here... | |
# Include all config files in /etc/rsyslog.d/ | |
$IncludeConfig /etc/rsyslog.d/*.conf | |
# Set the target host here by replacing 127.0.0.1 | |
*.* @127.0.0.1:10514;ls_json |
This comment has been minimized.
This comment has been minimized.
rsyslog doesn't understand that template... is it -ng or some other variant ? |
This comment has been minimized.
This comment has been minimized.
You probably have an rsyslog version older than 6 if this does not work. |
This comment has been minimized.
This comment has been minimized.
Hi, any working version ?? |
This comment has been minimized.
This comment has been minimized.
I use this tutorial but get Error.
Logstash Side
I get Error when recive log from
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This comment has been minimized.
logstash-json.conf
in this example is more properly/etc/rsyslog.d/logstash-json.conf