How to let Rsyslog parse the 'message' field as the actual syslog message

[wtliuNA]

Environment

• rsyslog version: 8.35.0
• for configuration questions/issues, include rsyslog.conf and included config files

In our environment, we have Rsyslog instances receiving logs which are forwarded through load balancers.

With rsyslog.confg(input part) like this:

module(load="imuxsock")
module(load="imtcp")
input( Type="imtcp" Port="514" Address="address" )

template(
name="structured_json"
type="string"
string={% raw %}"{%timestamp:::date-rfc3339,jsonf:ts%,%HOSTNAME:::jsonf:hostname%,%FROMHOST-IP:::jsonf:ip%,%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:sev%,%procid:::jsonf:pid%,%syslogtag:::jsonf:tag%,%programname:::jsonf:prog%, %msg:::jsonf%}\n"{% endraw %}
)

It seems the messages we received are parsed into:
{"ts":"2019-11-06T23:35:41+00:00","hostname":"LB_ip_addr","ip":"LB_ip_addr","facility":"user","sev":"notice","pid":"-","tag":"some_tag","prog":"some_prog", "msg":" <11>2019-10-06T23:01:55.840Z hostname1 test[1] This is the real message"}

So we want the output to be parsed from the actual syslog message that is currently nested in the 'message' field. e.g. output to be {"ts":"2019-10-06T23:01:55.840Z","hostname":"hostname1","ip":"","facility":"user","sev":"err","pid":"1","tag":"test[1]","prog":"test", "msg":" This is the real message"}

Is there a way to do that using existing modules from Rsyslog?

[davidelang]

you can use the mmnormalize module to parse the message, there is a pmnormalize parser module available that will let you define a parser to be used as the message arrives. templates have nothing to do with parsing messages, they are only used for formatting output. a couple samples of the rawmsg as it arrives would help us understand your problem. an example of "this is what arrives, this is what it gets parsed into, and this is what I expected it to get parsed into" would go a long way. David Lang

[wtliuNA]

Thanks @davidelang , let me standardize my question:

This is the raw syslog arrived:
Nov 7 08:40:54 794afc3bf567/794afc3bf567/11.50.3.5 <11>2019-10-06T23:01:55.840Z hostname1 test[1] This is the real message

And this is what it currently gets parsed into:
{"ts":"2019-11-07T08:40:54+00:00","hostname":"11.50.3.5","ip":"11.50.3.5","facility":"user","sev":"notice","pid":"-","tag":"794afc3bf567\/794afc3bf567","prog":"794afc3bf567", "msg":" <11>2019-10-06T23:01:55.840Z hostname1 test[1] This is the real message"}

And this is what I would expect the output to be:
{"ts":"2019-10-06T23:01:55.840Z","hostname":"hostname1","ip":"","facility":"user","sev":"err","pid":"1","tag":"test[1]","prog":"test", "msg":" This is the real message"}

[davidelang]

On Thu, 7 Nov 2019, wentao wrote: This is the raw syslog arrived: `Nov 7 08:40:54 794afc3bf567/794afc3bf567/11.50.3.5 <11>2019-10-06T23:01:55.840Z hostname1 test[1] This is the real message` And this is what it currently gets parsed into: `{"ts":"2019-11-07T08:40:54+00:00","hostname":"11.50.3.5","ip":"11.50.3.5","facility":"user","sev":"notice","pid":"-","tag":"794afc3bf567\/794afc3bf567","prog":"794afc3bf567", "msg":" <11>2019-10-06T23:01:55.840Z hostname1 test[1] This is the real message"}` And this is what I would expect the output to be: `{"ts":"2019-10-06T23:01:55.840Z","hostname":"hostname1","ip":"","facility":"user","sev":"err","pid":"1","tag":"test[1]","prog":"test", "msg":" This is the real message"}`

Thanks, that makes it clear. you can use mmnormalize to parse the msg field or you can use the pmnormalize module to create a custom parser that you can use as the message arrives. The mmnormalize parser will create variables in the $! or $. namespace that you can use in a custom template, the pmnormalize parser will populate the standard properies (at least as I understand it, I haven't needed to use pmnormalize yet, even through I was an advocate of getting it added) David Lang