はじめてのrsyslog

10-json.conf

module(load="imudp")
module(load="imtcp")
module(load="mmjsonparse")

# Listen on port 514
input(type="imudp" port="514")
input(type="imtcp" port="514")


template(name="Identity" type="list") {
    property(name="msg")
    constant(value="\n")
}

template(name="JSON" type="list") {
    constant(value="{")
    constant(value="\"timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"severity\":\"")   property(name="syslogseverity-text")
    constant(value="\",\"facility\":\"")   property(name="syslogfacility-text")
    constant(value="\",\"tag\":\"")        property(name="syslogtag" format="json")
    constant(value="\",\"message\":\"")      property(name="msg" format="json")
    constant(value="\"}\n")
}

if $syslogtag startswith 'MyDockerLogger' then {
    action(type="mmjsonparse" cookie="")
    if $parsesuccess == "OK" then {
        if $!severity == "error" then {
            action(
                type="omfile"
                file="/var/log/docker.error.log"
                ioBufferSize="64k"
                fileOwner="hogeyama"
                fileGroup="hogeyama"
                fileCreateMode="0644"
                template="Identity")
        }
        action(
            type="omfile"
            file="/var/log/docker.log"
            ioBufferSize="64k"
            fileOwner="hogeyama"
            fileGroup="hogeyama"
            fileCreateMode="0644"
            template="Identity")
    } else {
        action(
            type="omfile"
            file="/var/log/docker.error.log"
            ioBufferSize="64k"
            fileOwner="hogeyama"
            fileGroup="hogeyama"
            fileCreateMode="0644"
            template="JSON")
    }
}


# こんな感じのcompose.ymlでテストできる
# services:
#   app:
#     image: alpine:latest
#     command: sh -c 'echo "$*"' -- '{"foo":"bar","severity":"error"}'
#     logging:
#       driver: syslog
#       options:
#         syslog-address: "udp://localhost:514"
#         tag: "MyDockerLogger/{{.Name}}/{{.ID}}"
#         syslog-format: "rfc5424micro"