gistfile1.txt

module(load="omelasticsearch")

# this is for index names to be like: logstash-YYYY.MM.DD
template(name="logstash-index"  type="list") {
 constant(value="logstash-")
 property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
 constant(value=".")
 property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
 constant(value=".")
 property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
}

# this is for formatting our syslog in JSON with @timestamp
template(name="plain-syslog" type="list") {
 constant(value="{")
 constant(value="\"@timestamp\":\"")       property(name="timereported" dateFormat="rfc3339")
 constant(value="\",\"@host\":\"")         property(name="hostname")
 constant(value="\",\"@fromhost-ip\":\"")  property(name="fromhost-ip")
 constant(value="\",\"@severity\":\"")     property(name="syslogseverity-text")
 constant(value="\",\"@facility\":\"")     property(name="syslogfacility-text")
 constant(value="\",\"@syslogtag\":\"")    property(name="syslogtag" format="json")
 constant(value="\",\"@message\":\"")      property(name="msg" format="json")
 constant(value="\"}")
}

# Another ERB-fied version that's functional, but hard to read.

module(load="omudpspoof")
module(load="omelasticsearch")

template(name="udp_to_long_term" type="string" string="%rawmsg%")

template(name="to_elasticsearch_json" type="string" string="{%msg:::jsonf:@message%,%fromhost:::jsonf:@fromhost%,%syslogfacility-text:::,jsonf:@facility%,%syslogpriority-text:::jsonf:@priority%,%timereported:::date-rfc3339,jsonf:@timestamp%}")

template(name="search_index"
  type="string"
  string="riot_rsyslog-%timereported:1:10:date-rfc3339%"
)

ruleset(name="<%= @rsyslog_protocol %>-<%= @rsyslog_port %>"){
  action(type="omudpspoof"
  target="<%= @long_term_server %>"
  template="udp_to_long_term"
  )
  action(type="omelasticsearch"
    template="to_elasticsearch_json"
    searchIndex="search_index"
    server="<%= @elasticsearch_server %>"
    serverport="<%= @elasticsearch_port %>"
    dynSearchIndex="on"
    <% if @elasticsearch_debug == true %>
 <%=errorFile="/var/log/es-error.log" %>
    <% end %>
  )
}
input(type="imudp" port="<%= @rsyslog_port %>" ruleset="<%= @rsyslog_protocol %>-<%= @rsyslog_port %>")