syslog-ng Open Source Edition 3.16 - Release Notes

$(basename argument)
$(context-lookup [option] condition value-to-select)
$(context-lookup ("${username}" == "root") ${tags})
$(context-values $name-value1 $name-value2 ...)
$(dirname argument)
$(echo argument)
$(env <environment-variable>)
@module cef
options {
   on-error("drop-property");
};
$(format-cef-extension --scope syslog,all_macros,selected_macros \
  --exclude R_* --exclude S_* --key .SDATA.meta.sequenceId \
  --pair MSGHDR=\"$PROGRAM[$PID]: \")
template("$(format-cef-extension --subkeys .cef.)\n")
destination d_cef_extension {
    file("/var/log/messages.cef" template("${ISODATE} ${HOST} $(format-cef-extension --scope selected_macros --scope nv_pairs)\n"));
};
$(format-cim)
destination d_cim {
    network(
        "192.168.1.1"
        template("$(format-cim)\n")
    );
};
$(format-ewmm)
<13>1 2018-05-13T13:27:50.993+00:00 my-host @syslog-ng - - -
{"MESSAGE":"<34>Oct 11 22:14:15 mymachine su: 'su root' failed for username on
/dev/pts/8","HOST_FROM":"my-host","HOST":"my-host","FILE_NAME":"/tmp/in","._TAGS":".source.s_file"}
$(format-gelf)
destination graylog2 { 
    network(
        "127.0.0.1"
        port(12201)
        transport(tcp)
        template("$(format-gelf)")
    );
};
$(format-json parameters)
$(format-json --scope syslog,all_macros,selected_macros \
  --exclude R_* --exclude S_* --key .SDATA.meta.sequenceId \
  --pair MSGHDR=\"$PROGRAM[$PID]: \")
destination d_json {
    file(
        "/var/log/messages.json"
        template("$(format-json --scope selected_macros --scope nv_pairs)\n")
    );
};
$(format-welf --scope syslog,all_macros,selected_macros \
  --exclude R_* --exclude S_* --key .SDATA.meta.sequenceId \
  --pair MSGHDR=\"$PROGRAM[$PID]: \")
destination d_welf {
    file(
        "/var/log/messages.welf"
        template("$(format-welf --scope selected_macros --scope nv_pairs)\n")
    );
};
$(geoip <IPv4-address>)
$(geoip2 --database <path-to-geoip2-database-file>
    [ --field "registered_country.names.ru" ] ${HOST})
$(getent)
$(getent passwd testuser name)
$(getent passwd testuser uid)
$(getent passwd testuser gid)
$(getent passwd testuser gecos)
$(getent passwd testuser dir)
$(getent passwd testuser shell)
$(getent passwd 1000 name)
$(getent passwd 1000 uid)
$(getent passwd 1000 gid)
$(getent passwd 1000 gecos)
$(getent passwd 1000 dir)
$(getent passwd 1000 shell)
$(getent group adm name)
$(getent group adm gid)
$(getent group adm members)
$(getent protocols tcp)
$(getent protocols 6)
$(getent services http)
$(getent services 80)
$(graphite-output parameters)
destination d_graphite {
    network( host("localhost") port(2003) template("$(graphite-output --key vmstat.*)"));
};
$(grep condition value-to-select)
$(grep ("${username}" == "root") ${auth_method})
$(<method> [opts] $arg1 $arg2 $arg3...)
--length N, -l N
$(sha1 $HOST)
$(sha1 $HOST salted)
$(sha1 --length 6 $HOST)
rewrite r_rewrite_hostname{set("$(sha1 $HOST)", value("HOST"));};
rewrite pseudonymize_ip_addresses_in_message {subst ("((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])[.]){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))", "$(sha1 $0)", value("MESSAGE"));};
$(if (<condition>) <true template> <false template>)
$(if ("${username}" == "root") "violation" "system")
<value name="username">$(if ("${username}" == "root") "violation" "system")</value>
<value name="username">
    $(if ("${username}" == "root")
        "root"
        $(if ("${username}" == "joe") "admin" "normal user"))</value>
$(indent-multi-line parameter)
destination d_file {
    file (
        "/var/log/messages"
        template("${ISODATE} ${HOST} $(indent-multi-line ${MESSAGE})\n")
    );
};
$(ipv4-to-int parameter)
$(list-append ${list} ${name-value-pair1} ${name-value-pair2} ... )
$(list-concat ${name-value-pair1} ${name-value-pair2} ... )
$(list-concat ${list1} ${list2})
$(list-count ${list} )
$(list-head ${list} )
$(list-nth <index-number> ${list} )
$(list-tail ${list} )
$(list-slice <from>:<to> ${list} )
$(length "<macro>")
f_short {
    match ('-', value ("$(if ($(length "${MESSAGE}") <= 16) "-" "+")"));
};
$(lowercase "<macro>")
destination d_file {
    file ("/var/log/${MONTH}/${DAY}/$(lowercase "${HOST}")/messages");
};
$(<operation> "<value1>" "<value2>")
$(+ "${<MACRO1>}" "${<MACRO2>}");
$(max ${.myfields.load})
$(or <macro1> <macro2>)
 $(padding <macro> <width> <prepended-character-or-string>)
$(padding ${MESSAGE} 10 X)
$(padding ${MESSAGE} 10 foo)
 $(python <name-of-the-python-method-to-use> <arguments-of-the-method>)
python {
def <name_of_the_python_function>(<log_message>, <optional_other_arguments>):
    # <your-python-code>
    return <value_of_the_template_function>
};

template <template-name> {
    template($(python <name_of_the_python_function>));
};
@version: 3.16

python {
def return_message(log_message):
    return log_message.MESSAGE
};

destination d_local {
    file("/tmp/logs.txt" template("[$(python return_message)]\n"));
};
@version: 3.16

python {
import socket

def resolve_host(log_message, hostname):
    try:
        return socket.gethostbyaddr(hostname)[0]
    except (socket.herror, socket.error):
        return 'unknown'
};

destination d_local {
    file(
        "/tmp/logs.txt"
        template("${ISODATE} $(python resolve_host(${SOURCE_IP})) ${MESSAGE}\n")
    );
};
$(replace-delimiter "<old-delimiters>" "<new-delimiter>" "<macro>")
$(replace-delimiter "\t" ";" "${MESSAGE}")
$(sanitize <options> "<macro1>" "<macro2> ...")
$(sanitize -i \@ $PROGRAM)
$(sanitize -r ; $PROGRAM)
file("/var/log/$(sanitize $HOST $PROGRAM)/messages");
$(stardate [option] "<date-in-unixtime>")
$(stardate --digits 2 "${R_UNIXTIME}")
$(strip "<macro>")
$(strip "${MESSAGE}" "${PROGRAM}")
$(substr "<argument>" "<offset>" "<length>")
$(substr "${MESSAGE}" "15");
$(substr "${MESSAGE}" "15" "15");
$(substr "${MESSAGE}" "-15");
template t_truncate_messages {
    template("$(substr \"<$PRI>$DATE $HOST $MSGHDR$MESSAGE\" \"0\" \"1023\")\n");
    template-escape(no);
};
$(uppercase "<macro>")
destination d_file {
    file ("/var/log/${MONTH}/${DAY}/$(uppercase "${HOST}")/messages");
};
$(urlencode ${MSG} )\n")
$(uuid)
rewrite r_add_uuid {
    set("$(uuid)" value("MESSAGE_UUID"));
};

destination d_file {
    file (
        "/var/log/messages"
        template("$MESSAGE_UUID $ISODATE $HOST $MSG\n")
        template-escape(no)
    );
};

log {
    source(s_network);
    rewrite(r_add_uuid);
    destination(d_file);
};

syslog-ng Open Source Edition 3.16 - Release Notes

Template functions of syslog-ng OSE

basename

context-lookup

Example: Using the context-lookup template function

context-values

dirname

echo

env

format-cef-extension

Example: Using the format-cef-extension template function

format-cim

format-ewmm

format-gelf

Example: Using the format-gelf template function

format-json

Example: Using the format-json template function

format-welf

Example: Using the format-welf() template function

geoip (DEPRECATED)

geoip2

getent

graphite-output

Example: Using the graphite-output template function

grep

Example: Using the grep template function

hash

Example: Using the $(hash) template function

Example: Anonymizing IP addresses

if

Example: Using pattern databases and the if template function

indent-multi-line

Example: Using the indent-multi-line template function

ipv4-to-int

List manipulation

list-append

list-concat

list-count

list-head

list-nth

list-tail

list-slice

length

lowercase

Numerical operations

or

padding

Example: Using the padding template function

python

Declaration:

Example: Writing template functions in Python

replace-delimiter

sanitize

Example: Using the sanitize template function

stardate

strip

substr

Example: Using the substr template function

uppercase

urlencode

uuid

Example: Using Universally Unique Identifiers

Feedback Submitted.

Leave a Comment