Mailing List Archive: Rsyslog Json Logs To Folders Based On Log Received Time

Rsyslog Json Logs To Folders Based On Log Received Time

Dec 1, 2021, 4:02 AM

Post #1 of 3 (370 views)

Hi

I am trying to store logs as JSON to folders based on logs received time.
The folder should be like /var/logs/logs_folder/2021/12/1/23/59.log

I tried the below config but it's not working. String template working fine but JSON is not working.

template(name="json-template"
type="list") {
constant(value="{")
constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
constant(value="\",\"@version\":\"1")
constant(value="\",\"message\":\"") property(name="msg" format="json")
constant(value="\",\"sysloghost\":\"") property(name="hostname")
constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
constant(value="\",\"programname\":\"") property(name="programname")
constant(value="\",\"procid\":\"") property(name="procid")
constant(value="\"}\n")
}
$template json-template,"/var/log/logs_folder/%$year%/%$month%/%$day%/%$hour%.log"

It's creating folders inside /var/log/logs_folder/%$year%/%$month%/%$day%/%$hour%.log but not actual /var/log/logs_folder/2021/12/1/.....log

Thank you
[4b4654de-98b9-4630-83b9-ab7b37cc9b42]

--
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Rsyslog Json Logs To Folders Based On Log Received Time [ In reply to ]

rsyslog at lists

Dec 1, 2021, 4:14 AM

Post #2 of 3 (370 views)

Permalink

action definition?

Raienr

El mié, 1 dic 2021 a las 13:03, One Zero Art via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hi
>
> I am trying to store logs as JSON to folders based on logs received time.
> The folder should be like /var/logs/logs_folder/2021/12/1/23/59.log
>
> I tried the below config but it's not working. String template working fine but JSON is not working.
>
>
>
> template(name="json-template"
> type="list") {
> constant(value="{")
> constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
> constant(value="\",\"@version\":\"1")
> constant(value="\",\"message\":\"") property(name="msg" format="json")
> constant(value="\",\"sysloghost\":\"") property(name="hostname")
> constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
> constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
> constant(value="\",\"programname\":\"") property(name="programname")
> constant(value="\",\"procid\":\"") property(name="procid")
> constant(value="\"}\n")
> }
> $template json-template,"/var/log/logs_folder/%$year%/%$month%/%$day%/%$hour%.log"
>
> It's creating folders inside /var/log/logs_folder/%$year%/%$month%/%$day%/%$hour%.log but not actual /var/log/logs_folder/2021/12/1/.....log
>
> Thank you
> [4b4654de-98b9-4630-83b9-ab7b37cc9b42]
>
> --
> This email has been checked for viruses by Avast antivirus software.
> https://www.avast.com/antivirus
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Rsyslog Json Logs To Folders Based On Log Received Time [ In reply to ]

rsyslog at lists

Dec 1, 2021, 8:48 AM

Post #3 of 3 (370 views)

Permalink

Please show us the rest of your config (we see how these templates are being
used.

one problem is that you have two templates named 'json-template' try using
different names for the filename and the content.

David Lang

On Wed, 1 Dec 2021, One Zero Art via rsyslog wrote:

> Hi
>
> I am trying to store logs as JSON to folders based on logs received time.
> The folder should be like /var/logs/logs_folder/2021/12/1/23/59.log
>
> I tried the below config but it's not working. String template working fine but JSON is not working.
>
>
>
> template(name="json-template"
> type="list") {
> constant(value="{")
> constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
> constant(value="\",\"@version\":\"1")
> constant(value="\",\"message\":\"") property(name="msg" format="json")
> constant(value="\",\"sysloghost\":\"") property(name="hostname")
> constant(value="\",\"severity\":\"") property(name="syslogseverity-text")
> constant(value="\",\"facility\":\"") property(name="syslogfacility-text")
> constant(value="\",\"programname\":\"") property(name="programname")
> constant(value="\",\"procid\":\"") property(name="procid")
> constant(value="\"}\n")
> }
> $template json-template,"/var/log/logs_folder/%$year%/%$month%/%$day%/%$hour%.log"
>
> It's creating folders inside /var/log/logs_folder/%$year%/%$month%/%$day%/%$hour%.log but not actual /var/log/logs_folder/2021/12/1/.....log
>
> Thank you
> [4b4654de-98b9-4630-83b9-ab7b37cc9b42]
>
> --
> This email has been checked for viruses by Avast antivirus software.
> https://www.avast.com/antivirus
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.