0

rsyslog is powerful, but its docs aren't that explicit. I can't figure out how to parse a log file and route it directly to Graylog in GELF format.

I have found bits of documentation about outputing gelf in rsyslog but I'm not sure how to proceed.

So far, it tried to place the below conf in /etc/rsyslog.d/01-access.conf but that doesn't seem to work…

template(name="gelf" type="list") {
    constant(value="{\"version\":\"1.1\",")
    constant(value="\"host\":\"")
    property(name="hostname")
    constant(value="\",\"short_message\":\"")
    property(name="msg" format="json")
    constant(value="\",\"timestamp\":\"")
    property(name="timegenerated" dateformat="unixtimestamp")
    constant(value="\",\"level\":\"")
    property(name="syslogseverity")
    constant(value="\"}")
}

input(type="imfile"
      File="/var/log/apache2/access.log"
      Tag="apache-access"
)

if $programname == 'apache-access' then {
    action(
        type="omfwd"
        Target="GRAYLOG-IP"
        Port="12201"
        Protocol="tcp"
        template="gelf"
    )
    stop
}
4

You encounter this issue because sending via tcp is not working with rsyslog due to Gelf's null-byte message delimiter spec. From the official rsyslog documentation: (http://www.rsyslog.com/doc/v8-stable/tutorials/gelf_forwarding.html) "Please note that the case above only works for UDP transport. When using TCP, Graylog expects a Nullbyte as message delimiter. This is currently not possible with rsyslog." Your example should however work via udp.

A word of advice, I would definitely recommend checking out rsyslog filter rules as message processing will continue with your example (check out the tilde character).

0

Lifted From: https://www.rsyslog.com/doc/master/tutorials/gelf_forwarding.html

When using TCP, Graylog expects a Nullbyte as message delimiter. So, to use TCP, you need to change delimiter via TCP_FrameDelimiter option.

action(type="omfwd" target="graylogserver" port="12201" protocol="tcp" template="gelf" TCP_FrameDelimiter="0" KeepAlive="on")

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.