Adding Tag (i.e. Source IP) to rsyslog for sending to rsyslog remote server

rsyslogsyslog

Is there any way to adding a Tag to Logs which sent by rsyslog?
I send these logs to another server, and I can detect source IP as destination, but I need to adding tag in source.

Best Answer

You should be able to match the hostname of the system emitting your log. Isn't that enough?

Rsyslog has an option $PreserveFQDN on, to replace that hostname with your FQDN, which is probably better with syslog concentrators, ...

I suppose on the other end you have some logstash or elasticsearch? Either way, rsyslog also allows you to define templates such as:

template(name="jsonfmt" type="list" option.json="on") {
    constant(value="{")
    constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"@version\":\"1")
    constant(value="\",\"message\":\"") property(name="msg")
    constant(value="\",\"@fields.host\":\"") property(name="hostname")
    constant(value="\",\"@fields.severity\":\"") property(name="syslogseverity-text")
    constant(value="\",\"@fields.facility\":\"") property(name="syslogfacility-text")
    constant(value="\",\"@fields.programname\":\"") property(name="programname")
    constant(value="\",\"@fields.procid\":\"") property(name="procid")
    constant(value="\",\"@fields.mytag\":\"foobarStaticTag\"}\n")
}

local7.* @logstash.example.com:1514;jsonfmt
local7.* action(type="omelasticsearch"
       action.resumeretrycount="-1"
       dynSearchIndex="on"
       bulkmode="on"
       queue.type="linkedlist"
       queue.size="1000000"
       queue.dequeuebatchsize="1000"
       queue.workerthreads="2"
       searchIndex="logidx"
       server="esearchgw.example.com"
       template="jsonfmt")

Note that the sample logstash forwarder assumes your input definition includes codec => json. The foobarStaticTag being whatever Tag you wanted to add.

Related Topic