# Rsyslog template

**URL:** <https://community.graylog.org/t/rsyslog-template/34021>\
**Category:** Miscellaneous\
**Tags:** filebeat-linux\
**Created:** [October 31, 2024, 2:20am UTC](https://community.graylog.org/t/rsyslog-template/34021 "2024-10-31T02:20:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![brettjouw](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@brettjouw](https://community.graylog.org/u/brettjouw)\
**Post date:** [October 31, 2024, 2:20am UTC](https://community.graylog.org/t/rsyslog-template/34021/1 "2024-10-31T02:20:25Z")

</div>

# Rsyslog Template

Our environment has syslog collectors that use rsyslog to listen and write the events to disk in JSON format. The events are then picked up by Filebeats and shipped to Graylog. Just wanted to share my config, if it helps anyone!

> _NOTE_: There are suppressions for several events, these can be removed if your do not require them.

```shell
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514" ruleset="remote_one")

template(name="json_template" type="list") {
    constant(value="{")
      constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"@version\":\"1")
      constant(value="\",\"message\":\"") property(name="msg")
      constant(value="\",\"source\":\"") property(name="hostname")
      constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
      constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
      constant(value="\",\"programname\":\"") property(name="programname")
      constant(value="\",\"procid\":\"") property(name="procid")
      constant(value="\",\"source\":\"") property(name="hostname")
      constant(value="\",\"forwarder\":\"") property(name="fromhost")
    constant(value="\"}\n")
}

#####
# %FTD-4-402119 = Anti-replay events
# %ASA-6-302014 = ICMP Teardowns
# %ASA-6-302021 = TCP Teardowns
#####

$template RemoteLogs, "/data/syslog/clients/%HOSTNAME%/%PROGRAMNAME%.log"
ruleset(name="remote_one"){
   if not (($programname == '%FTD-4-402119') or ($programname == '%ASA-6-302014') or ($programname == '%ASA-6-302021') or ($syslogseverity-text == 'debug')) then {
       action(type="omfile" dynafile="RemoteLogs" template="json_template")
   }
}

```

---

<div class="post-metadata">

**Author:** ![etgraylog1](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/etgraylog1/32/12528_2.png) [@etgraylog1](https://community.graylog.org/u/etgraylog1)\
**Post date:** [November 6, 2024, 6:41pm UTC](https://community.graylog.org/t/rsyslog-template/34021/2 "2024-11-06T18:41:05Z")

</div>

Very cool @brettjouw, thank you!