rsyslog-include.conf

module(load="omelasticsearch")

# define a template to specify which fields we send

template(name="LogseneFormat" type="list" option.json="on") {
  constant(value="{")
  constant(value="\"@timestamp\":\"")
  property(name="timereported" dateFormat="rfc3339")
  constant(value="\",\"message\":\"")
  property(name="msg")
  constant(value="\",\"host\":\"")
  property(name="hostname")
  constant(value="\",\"severity\":\"")
  property(name="syslogseverity-text")
  constant(value="\",\"facility\":\"")
  property(name="syslogfacility-text")
  constant(value="\",\"syslog-tag\":\"")
  property(name="syslogtag")
  constant(value="\",\"source\":\"")
  property(name="programname")
  constant(value="\"}")
}


template(name="LogseneInputTemplate" type="list")
  {
  # standard syslog fields
  constant(value="<")
  property(name="pri")
  constant(value=">")
  property(name="timereported" dateFormat="rfc3164")
  constant(value=" ")
  property(name="hostname")
  constant(value=" ")
  property(name="syslogtag")
  # CEE-formatted JSON message over syslog
  constant(value="@cee: {\"logsene-app-token\": \"TOKEN\", \"message\": \"")
  property(name="msg" format="json")    # original syslog message goes in the "message" field
  constant(value="\"}\n")
}

action(type="omelasticsearch"
    template="LogseneFormat"          # the template that you defined earlier
    searchIndex="TOKEN"
    server="logsene-receiver.sematext.com"
    serverport="80"
    bulkmode="on"
    queue.dequeuebatchsize="100"      # how many messages to send at once
    action.resumeretrycount="-1"      # buffer messages if connection fails
    errorfile="/data/logs/omelasticsearch.log")