summaryrefslogtreecommitdiffstats
path: root/source/configuration/modules/omjournal.rst
blob: fd250a4c0c6a8753bb19c4fe1af07d5dda88d7b4 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
*********************************
omjournal: Systemd Journal Output
*********************************

===========================  ===========================================================================
**Module Name:**             **omjournal**
**Author:**                  `Rainer Gerhards <https://rainer.gerhards.net/>`_ <rgerhards@adiscon.com>
===========================  ===========================================================================


Purpose
=======

This module provides native support for logging to the systemd journal.


Configuration Parameters
========================

.. note::

   Parameter names are case-insensitive.


Action Parameters
-----------------

Template
^^^^^^^^

.. csv-table::
   :header: "type", "default", "mandatory", "|FmtObsoleteName| directive"
   :widths: auto
   :class: parameter-table

   "word", "none", "no", "none"

Template to use when submitting messages.

By default, rsyslog will use the incoming %msg% as the MESSAGE field
of the journald entry, and include the syslog tag and priority.

You can override the default formatting of the message, and include
custom fields with a template. Complex fields in the template
(eg. json entries) will be added to the journal as json text. Other
fields will be coerced to strings.

Journald requires that you include a template parameter named MESSAGE.


Examples
========

Example 1
---------

The following sample writes all syslog messages to the journal with a
custom EVENT_TYPE field.

.. code-block:: none

   module(load="omjournal")

   template(name="journal" type="list") {
     constant(value="Something happened" outname="MESSAGE")
     property(name="$!event-type" outname="EVENT_TYPE")
   }

   action(type="omjournal" template="journal")