Templates¶

Description¶

Templates are a key feature of rsyslog. They define arbitrary output formats and enable dynamic file name generation. Every output, including files, user messages, and database writes, relies on templates. When no explicit template is set, rsyslog uses built-in defaults compatible with stock syslogd formats. Key elements of templates are rsyslog properties; see rsyslog properties.

Template processing¶

When defining a template it should include a HEADER as defined in RFC5424. Understanding rsyslog parsing is important. For example, if the MSG field is "this:is a message" and neither HOSTNAME nor TAG are specified, the outgoing parser splits the message as:

TAG:this:
MSG:is a message

The `template()` object¶

Templates are defined with the template() object, which is a static construct processed when rsyslog reads the configuration. Basic syntax:

template(parameters)

List templates additionally support an extended syntax:

template(parameters) { list-descriptions }

Parameters name and type select the template name and type. The name must be unique. See below for available types and statements.

Template types¶

Topic	Summary
List template type	List templates build output from a sequence of constant and property statements. They suit complex substitutions and structure-aware outputs.
Subtree template type	Builds output from an entire CEE subtree. Useful for hierarchical data where the structure is prepared beforehand.
String template type	Uses a single template string mixing constants and replacement variables. Best suited for textual output with simple manipulation needs.
Plugin template type	Delegates string generation to a plugin for maximum performance. Configuration selects the plugin by name.

Template statements¶

Topic	Summary
Constant statement	Outputs literal text. Supports escape sequences and optional JSON field formatting when an outname and format are specified.
Property statement	Extracts and optionally transforms message properties. Supports substring, case, regex, JSON formatting, and more.

Additional topics¶

Topic	Summary
Template options	Global modifiers applied to a template. Include SQL and JSON helpers and case sensitivity control.
Template examples	Practical templates for files, forwarding, databases, JSON output, and dynamic file names.
Reserved template names	Names beginning with `RSYSLOG_` are reserved. The following templates are predefined and may be used without explicit definition.
Legacy $template statement	Historic syntax supporting only string templates. Kept for compatibility with older configurations.

Reserved template names overview¶

Name	Purpose
RSYSLOG_TraditionalFileFormat	Old style log file format
RSYSLOG_FileFormat	Modern logfile format with high-precision timestamps
RSYSLOG_TraditionalForwardFormat	Traditional forwarding with low-precision timestamps
RSYSLOG_SysklogdFileFormat	Sysklogd compatible format
RSYSLOG_ForwardFormat	High-precision forwarding format
RSYSLOG_SyslogProtocol23Format	Format from IETF draft syslog-protocol-23
RSYSLOG_DebugFormat	Troubleshooting format listing all properties
RSYSLOG_WallFmt	Host and time followed by tag and message
RSYSLOG_StdUsrMsgFmt	Syslogtag followed by the message
RSYSLOG_StdDBFmt	Insert command for MariaDB/MySQL
RSYSLOG_StdPgSQLFmt	Insert command for PostgreSQL
RSYSLOG_spoofadr	Sender IP address only
RSYSLOG_StdJSONFmt	JSON structure of message properties

Legacy `$template` statement¶

For historical configurations, the legacy $template syntax is still recognized. See Legacy $template statement for details.