0

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format.

I have found bits of documentation about outputing gelf in rsyslog but I'm not sure how to proceed.

So far, it tried to place the below conf in /etc/rsyslog.d/01-access.conf but that doesn't seem to work…

template(name="gelf" type="list") {
    constant(value="{\"version\":\"1.1\",")
    constant(value="\"host\":\"")
    property(name="hostname")
    constant(value="\",\"short_message\":\"")
    property(name="msg" format="json")
    constant(value="\",\"timestamp\":\"")
    property(name="timegenerated" dateformat="unixtimestamp")
    constant(value="\",\"level\":\"")
    property(name="syslogseverity")
    constant(value="\"}")
}

input(type="imfile"
      File="/var/log/apache2/access.log"
      Tag="apache-access"
)

if $programname == 'apache-access' then {
    action(
        type="omfwd"
        Target="GRAYLOG-IP"
        Port="12201"
        Protocol="tcp"
        template="gelf"
    )
    stop
}

2 Answers 2

4

You encounter this issue because sending via tcp is not working with rsyslog due to Gelf's null-byte message delimiter spec. From the official rsyslog documentation: (http://www.rsyslog.com/doc/v8-stable/tutorials/gelf_forwarding.html) "Please note that the case above only works for UDP transport. When using TCP, Graylog expects a Nullbyte as message delimiter. This is currently not possible with rsyslog." Your example should however work via udp.

A word of advice, I would definitely recommend checking out rsyslog filter rules as message processing will continue with your example (check out the tilde character).

0

Lifted From: https://www.rsyslog.com/doc/master/tutorials/gelf_forwarding.html

When using TCP, Graylog expects a Nullbyte as message delimiter. So, to use TCP, you need to change delimiter via TCP_FrameDelimiter option.

action(type="omfwd" target="graylogserver" port="12201" protocol="tcp" template="gelf" TCP_FrameDelimiter="0" KeepAlive="on")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .