rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format.
I have found bits of documentation about outputing gelf in rsyslog but I'm not sure how to proceed.
So far, it tried to place the below conf in /etc/rsyslog.d/01-access.conf
but that doesn't seem to work…
template(name="gelf" type="list") {
constant(value="{\"version\":\"1.1\",")
constant(value="\"host\":\"")
property(name="hostname")
constant(value="\",\"short_message\":\"")
property(name="msg" format="json")
constant(value="\",\"timestamp\":\"")
property(name="timegenerated" dateformat="unixtimestamp")
constant(value="\",\"level\":\"")
property(name="syslogseverity")
constant(value="\"}")
}
input(type="imfile"
File="/var/log/apache2/access.log"
Tag="apache-access"
)
if $programname == 'apache-access' then {
action(
type="omfwd"
Target="GRAYLOG-IP"
Port="12201"
Protocol="tcp"
template="gelf"
)
stop
}