Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using the remote syslog plugin, is there a way to get the original syslog message - without the tag / hostname / timestamp ? #53

Open
jtsmith342 opened this issue Dec 7, 2022 · 0 comments

Comments

@jtsmith342
Copy link

When using the remote syslog plugin, it injects a new timestamp, a new tag (fluentd by default) and the hostname fields.
My understanding is as follows:

  • the timestamp is for the time the event is forwarded by the Syslog Server to the Remote Syslog server
  • the tag is fluentd, by default
  • the hostname is the syslog server forwarding the events to this Remote Syslog Server

Is there a way to strip / transform the record at the Remote Syslog Server ?
So for instance, I'd like to remove the fluentd tag. I'd like the timestamp and host to match what is in the body of the message.
Please refer to the screenshot below. I'd like to get rid of the items in red and use the items in green instead.

My config is as follows:

##########
# INPUTS #
##########
# udp syslog
<source>
  @type syslog
  <transport udp>
  </transport>
  bind 0.0.0.0
  port 514
  tag syslog
  <parse>
    @type none
    message_format auto
    with_priority true
  </parse>
</source>

###########
# OUTPUTS #
###########
<match syslog**>
  @type copy
  <store>
    @type file
    path /var/log/td-agent/syslog
    compress gzip
  </store>
  <store>
     @type forward
     <server>
       host 192.168.0.2
       port 514
     </server>
  </store>
  <store>
     @type remote_syslog
     host 192.168.0.3
     port 514     
  </store>
</match>

The output as received by Kiwi Syslog is as shown -
image

Any inputs / suggestions / recommendations are welcome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant