rsyslog.conf

module(load="imptcp")
module(load="imudp" TimeRequery="10000")
module(load="imrelp")
module(load="imtcp" StreamDriver.AuthMode="anon" StreamDriver.Mode="1")
module(load="mmjsonparse")
module(load="mmutf8fix")
module(load="omelasticsearch")

global (
    maxMessageSize="10000"
    parser.escapeControlCharactersOnReceive="off"
    action.reportSuspension="on"
    action.reportSuspensionContinuation="on"
    defaultNetstreamDriver="gtls"
    defaultNetstreamDriverCAFile="/opt/sematext/rsyslog/ca.pem"
    defaultNetstreamDriverKeyFile="/opt/sematext/rsyslog/machine-key.pem"
    defaultNetstreamDriverCertFile="/opt/sematext/rsyslog/machine-cert.pem"
)

main_queue(
    queue.type="LinkedList"
    queue.size="2000000"
    queue.dequeueBatchSize="1000"
    queue.dequeueslowdown="10000"

    queue.spoolDirectory="/mnt/rsyslog/queues"
    queue.filename="main_queue"
    queue.maxfilesize="100m"
    queue.maxdiskspace="2g"
    queue.highwatermark="20000"
    queue.lowwatermark="10000"
    queue.saveonshutdown="on"
)

input(type="imptcp" port="514")
input(type="imudp"  port="514")
input(type="imtcp"  port="10514")
input(type="imrelp" port="20514")

template(name="lumberjack" type="list") {
    constant(value="{")
    constant(value="\"@timestamp\":\"")      property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"host\":\"")         property(name="hostname")
    constant(value="\",\"severity\":\"")     property(name="syslogseverity-text" caseConversion="upper")
    constant(value="\",\"facility\":\"")     property(name="syslogfacility-text")
    constant(value="\",\"syslog-tag\":\"")   property(name="syslogtag" format="json")
    constant(value="\",\"source\":\"")       property(name="app-name" format="json")
    constant(value="\",")                    property(name="$!all-json" position.from="2")
}

template(name="plain" type="list") {
    constant(value="{")
    constant(value="\"@timestamp\":\"")      property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"host\":\"")         property(name="hostname")
    constant(value="\",\"severity\":\"")     property(name="syslogseverity-text" caseConversion="upper")
    constant(value="\",\"facility\":\"")     property(name="syslogfacility-text")
    constant(value="\",\"syslog-tag\":\"")   property(name="syslogtag" format="json")
    constant(value="\",\"source\":\"")       property(name="app-name" format="json")
    constant(value="\",\"message\":\"")      property(name="msg" format="json")
    constant(value="\"}")
}

action(
  name="main_utf8fix"
  type="mmutf8fix"
  replacementChar="?"
)
action(
  name="main_cee_parser"
  type="mmjsonparse"
)

if $parsesuccess == "OK" then {
  action(
    name="es_json"
    type="omelasticsearch"
    server="logsene-token-receiver.prod.sematext.com"
    serverport="443"
    usehttps="on"
    template="lumberjack"
    searchIndex="TOKEN_GOES_HERE"
    searchType="syslog-cee"
    bulkmode="on"
    action.resumeRetryCount="5"
    action.resumeInterval="60"
  )
} else {
  action(
    name="es_nojson"
    type="omelasticsearch"
    server="logsene-token-receiver.prod.sematext.com"
    serverport="443"
    usehttps="on"
    template="plain"
    searchIndex="TOKEN_GOES_HERE"
    searchType="syslog"
    bulkmode="on"
    action.resumeRetryCount="5"
    action.resumeInterval="60"
  )
}