I have the following rsyslog config:

template(name="logz.io" type="string" string="[TOKEN] 
         <%pri%>%protocol-version% %timestamp:::date-rfc3339% [hostname] 
         %app-name% %procid% %msgid%  tag=\"syslog\"] %msg%\n")

# Send messages over TCP using the template.
action(type="omfwd" protocol="tcp" target="listener.logz.io" port="5001"
       template="logz.io" StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name" StreamDriverPermittedPeers="*.logz.io")

Now I would like to have the type="string" set according to one of the message type. So I could create individual templates for each type like

template(name="logz.io_nginx" type="nginx" string="[TOKEN] 
         <%pri%>%protocol-version% %timestamp:::date-rfc3339% [hostname] 
         %app-name% %procid% %msgid%  tag=\"nginx\"] %msg%\n")

However this means that the action should call the correct template based on the type.

  1. How would I configure rsyslog to use the same action with different template?
  2. Could I just have one template but for example the type parameter dynamically set dependent on the message type?

1 Answer 1


How is rsyslog supposed to know the message type, which is a logz concept and not an rsyslogd concept? You will probably have to distinguish the action based on syslogtag/programname, using an if statement, and chose the appropriate template within the if-then-block.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.