# Template examples

Practical templates for files, forwarding, databases, JSON output, and dynamic file names. .. summary-end

## Standard template for writing to files

    template(name="FileFormat" type="list") {
        property(name="timestamp" dateFormat="rfc3339")
        constant(value=" ")
        property(name="hostname")
        constant(value=" ")
        property(name="syslogtag")
        property(name="msg" spIfNo1stSp="on")
        property(name="msg" dropLastLf="on")
        constant(value="\n")
    }

Equivalent string template:

    template(name="FileFormat" type="string"
             string="%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n")

## Standard template for forwarding to a remote host (RFC3164)

    template(name="ForwardFormat" type="list") {
        constant(value="<")
        property(name="pri")
        constant(value=">")
        property(name="timestamp" dateFormat="rfc3339")
        constant(value=" ")
        property(name="hostname")
        constant(value=" ")
        property(name="syslogtag" position.from="1" position.to="32")
        property(name="msg" spIfNo1stSp="on")
        property(name="msg")
    }

Equivalent string template:

    template(name="ForwardFormat" type="string"
             string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%")

## Standard template for writing to the MariaDB/MySQL database

    template(name="StdSQLformat" type="list" option.sql="on") {
        constant(value="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)")
        constant(value=" values ('")
        property(name="msg")
        constant(value="', ")
        property(name="syslogfacility")
        constant(value=", '")
        property(name="hostname")
        constant(value="', ")
        property(name="syslogpriority")
        constant(value=", '")
        property(name="timereported" dateFormat="mysql")
        constant(value="', '")
        property(name="timegenerated" dateFormat="mysql")
        constant(value="', ")
        property(name="iut")
        constant(value=", '")
        property(name="syslogtag")
        constant(value="')")
    }

Equivalent string template:

    template(name="StdSQLformat" type="string" option.sql="on"
             string="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')")

## Generating JSON

Useful for RESTful APIs such as ElasticSearch.

    template(name="outfmt" type="list" option.jsonf="on") {
        property(outname="@timestamp" name="timereported" dateFormat="rfc3339" format="jsonf")
        property(outname="host" name="hostname" format="jsonf")
        property(outname="severity" name="syslogseverity" caseConversion="upper" format="jsonf" dataType="number")
        property(outname="facility" name="syslogfacility" format="jsonf" dataType="number")
        property(outname="syslog-tag" name="syslogtag" format="jsonf")
        property(outname="source" name="app-name" format="jsonf" onEmpty="null")
        property(outname="message" name="msg" format="jsonf")
    }

Produces output similar to:

    {"@timestamp":"2018-03-01T01:00:00+00:00", "host":"192.0.2.8", "severity":7, "facility":20, "syslog-tag":"tag", "source":"tag", "message":" msgnum:00000000:"}

Pretty-printed:

    {
      "@timestamp": "2018-03-01T01:00:00+00:00",
      "host": "192.0.2.8",
      "severity": 7,
      "facility": 20,
      "syslog-tag": "tag",
      "source": "tag",
      "message": " msgnum:00000000:"
    }

If `onEmpty="null"` is used and `source` is empty:

    {"@timestamp":"2018-03-01T01:00:00+00:00", "host":"192.0.2.8", "severity":7, "facility":20, "syslog-tag":"tag", "source":null, "message":" msgnum:00000000:"}

Note

The output is not pretty-printed in actual use to avoid waste of resources.

## Creating dynamic file names for `omfile`

Templates can generate dynamic file names. For example, to split syslog messages by host name:

    template(name="DynFile" type="string" string="/var/log/system-%HOSTNAME%.log")

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.