01-suri-rsyslog.conf

module(load="omelasticsearch")
module(load="mmjsonparse")

template(name="myformat" type="list") {
    constant(value="<")
    property(name="pri")
    constant(value=">")
    property(name="timestamp" dateFormat="rfc3339")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    property(name="syslogtag" position.from="1" position.to="32")
    property(name="msg" spifno1stsp="on" )
    property(name="msg")
    constant(value="\n")
    }

template(name="justmessage" type="list") {
    property(name="msg" spifno1stsp="on" )
    property(name="msg")
    constant(value="\n")
    }


template(name="syslog-plaintext-hourly" type="list") {
  constant(value="/srv/log/syslog/")
  property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="12" position.to="13")
}
template(name="cee-plaintext-hourly" type="list") {
  constant(value="/srv/log/cee/")
  property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="12" position.to="13")
}
template(name="suricata-plaintext-hourly" type="list") {
  constant(value="/srv/log/suricata/event_type/")
  property(name="$!event_type")
  constant(value="/")
  property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="9" position.to="10")
  constant(value=".")
  property(name="timereported" dateFormat="rfc3339" position.from="12" position.to="13")
}

template(name="JSON" type="list") {
  property(name="$!all-json" format="json")
}
template(name="JSON-file" type="list") {
  property(name="$!all-json" format="json")
  constant(value="\n")
}

$template PerSeverity,"/srv/log/severity/%syslogseverity-text%"
$template PerFacility,"/srv/log/facility/%syslogfacility-text%"
$template PerProgram,"/srv/log/program/%programname%"
$template PerSyslogtag,"/srv/log/program/%syslogtag:R,ERE,1,BLANK:([a-zA-Z\/]+)--end%"

$template PerSyslogtagDebug,"/srv/log/debug/%syslogtag:R,ERE,1,BLANK:([a-zA-Z\/]+)--end%"

if $msg startswith '@cee: ' or $msg startswith ' @cee: ' then {
  
  action(type="mmjsonparse")

  if $parsesuccess == 'OK' and $syslogtag contains 'suricata' then {
    action(
      type="omfile"
      dirCreateMode="0750"
      FileCreateMode="0644"
      DynaFile="suricata-plaintext-hourly"
      Template="JSON-file"
    )
    if $!event_type == 'alert' then {
      action(
        type="omfile"
        dirCreateMode="0750"
        FileCreateMode="0644"
        File="/srv/log/suricata/alert-all"
        Template="JSON-file"
      )
      if $!alert!severity == 1 then {
        action(
          type="omfile"
          dirCreateMode="0750"
          FileCreateMode="0644"
          File="/srv/log/suricata/alert-1"
          Template="JSON-file"
        )
      } else if $!alert!severity == 2 then {
        action(
          type="omfile"
          dirCreateMode="0750"
          FileCreateMode="0644"
          File="/srv/log/suricata/alert-2"
          Template="JSON-file"
        )
      }
    }
  }

  action(
    type="omfile"
    dirCreateMode="0750"
    FileCreateMode="0644"
    DynaFile="cee-plaintext-hourly"
    Template="JSON-file"
  )
} else {

  action(
    type="omfile"
    dirCreateMode="0750"
    FileCreateMode="0644"
    DynaFile="syslog-plaintext-hourly"
    Template="myformat"
  )

  *.* ?PerSeverity; myformat
  *.* ?PerFacility; myformat
  mail.* /srv/log/mail; myformat

  if $syslogtag startswith 'postfix' then {
    *.* ?PerSyslogtag; myformat
  }
}