# Reserved template names

Names beginning with `RSYSLOG_` are reserved. The following templates are predefined and may be used without explicit definition. .. summary-end

Template names starting with `RSYSLOG_` are reserved for rsyslog. Do not create custom templates with this prefix to avoid conflicts. The following predefined templates are available:

RSYSLOG_TraditionalFileFormat – “old style” default log file format with low-precision timestamps.

    template(name="RSYSLOG_TraditionalFileFormat" type="string"
         string="%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n")

RSYSLOG_FileFormat – modern logfile format similar to TraditionalFileFormat with high-precision timestamps and timezone information.

    template(name="RSYSLOG_FileFormat" type="list") {
         property(name="timereported" dateFormat="rfc3339")
         constant(value=" ")
         property(name="hostname")
         constant(value=" ")
         property(name="syslogtag")
         property(name="msg" spIfNo1stSp="on")
         property(name="msg" dropLastLf="on")
         constant(value="\n")
    }

RSYSLOG_TraditionalForwardFormat – traditional forwarding format with low-precision timestamps. Useful when sending to older syslogd instances.

    template(name="RSYSLOG_TraditionalForwardFormat" type="string"
         string="<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%")

RSYSLOG_SysklogdFileFormat – sysklogd compatible log file format. Use with options `$SpaceLFOnReceive on`, `$EscapeControlCharactersOnReceive off` and `$DropTrailingLFOnReception off` for full compatibility.

    template(name="RSYSLOG_SysklogdFileFormat" type="string"
         string="%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n")

RSYSLOG_ForwardFormat – high-precision forwarding format similar to the traditional one but with high-precision timestamps and timezone information.

    template(name="RSYSLOG_ForwardFormat" type="string"
         string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%")

RSYSLOG_SyslogProtocol23Format – format from IETF draft ietf-syslog-protocol-23, close to RFC5424.

    template(name="RSYSLOG_SyslogProtocol23Format" type="string"
         string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n")

RSYSLOG_DebugFormat – used for troubleshooting property problems. Write to a log file only; do not use for production or forwarding.

    template(name="RSYSLOG_DebugFormat" type="list") {
         constant(value="Debug line with all properties:\nFROMHOST: '")
         property(name="fromhost")
         constant(value="', fromhost-ip: '")
         property(name="fromhost-ip")
         constant(value="', HOSTNAME: '")
         property(name="hostname")
         constant(value="', PRI: '")
         property(name="pri")
         constant(value=",\nsyslogtag '")
         property(name="syslogtag")
         constant(value="', programname: '")
         property(name="programname")
         constant(value="', APP-NAME: '")
         property(name="app-name")
         constant(value="', PROCID: '")
         property(name="procid")
         constant(value="', MSGID: '")
         property(name="msgid")
         constant(value="',\nTIMESTAMP: '")
         property(name="timereported")
         constant(value="', STRUCTURED-DATA: '")
         property(name="structured-data")
         constant(value="',\nmsg: '")
         property(name="msg")
         constant(value="'\nescaped msg: '")
         property(name="msg" controlCharacters="drop")
         constant(value="'\ninputname: ")
         property(name="inputname")
         constant(value=" rawmsg: '")
         property(name="rawmsg")
         constant(value="'\n$!:")
         property(name="$!")
         constant(value="\n$.:")
         property(name="$.")
         constant(value="\n$/:")
         property(name="$/")
         constant(value="\n\n")
    }

RSYSLOG_WallFmt – information about host and time followed by the syslogtag and message.

    template(name="RSYSLOG_WallFmt" type="string"
         string="\r\n\7Message from syslogd@%HOSTNAME% at %timegenerated% ...\r\n%syslogtag%%msg%\n\r")

RSYSLOG_StdUsrMsgFmt – syslogtag followed by the message.

    template(name="RSYSLOG_StdUsrMsgFmt" type="string"
         string=" %syslogtag%%msg%\n\r")

RSYSLOG_StdDBFmt – insert command for table `SystemEvents` in MariaDB/MySQL.

    template(name="RSYSLOG_StdDBFmt" type="list") {
         constant(value="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)")
         constant(value=" values ('")
         property(name="msg")
         constant(value="', ")
         property(name="syslogfacility")
         constant(value=", '")
         property(name="hostname")
         constant(value="', ")
         property(name="syslogpriority")
         constant(value=", '")
         property(name="timereported" dateFormat="date-mysql")
         constant(value="', '")
         property(name="timegenerated" dateFormat="date-mysql")
         constant(value="', ")
         property(name="iut")
         constant(value=", '")
         property(name="syslogtag")
         constant(value="')")
    }

RSYSLOG_StdPgSQLFmt – insert command for table `SystemEvents` in pgsql.

    template(name="RSYSLOG_StdPgSQLFmt" type="string"
    string="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime,
         ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%',
         %syslogpriority%, '%timereported:::date-pgsql%', '%timegenerated:::date-pgsql%', %iut%,
         '%syslogtag%')")

RSYSLOG_spoofadr – message containing only the sender’s IP address.

    template(name="RSYSLOG_spoofadr" type="string" string="%fromhost-ip%")

RSYSLOG_StdJSONFmt – JSON structure containing message properties.

    template(name="RSYSLOG_StdJSONFmt" type="string"
         string="{\"message\":\"%msg:::json%\",\"fromhost\":\"%HOSTNAME:::json%\",\"facility\":\"%syslogfacility-text%\",\"priority\":\"%syslogpriority-text%\",\"timereported\":\"%timereported:::date-rfc3339%\",\"timegenerated\":\"%timegenerated:::date-rfc3339%\"}")

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.