nsyslog/examples/config/template.json

Modular new generation log agent. Reads, transform, aggregate, correlate and send logs from sources to destinations

{
	"include" : [
		"processors.json"
	],
	"servers" : {
		"udp" : {
			"protocol" : "udp4",
			"interface" : "0.0.0.0",
			"port" : "514"
		},
		"tcp" : {
			"protocol" : "tcp4",
			"interface" : "0.0.0.0",
			"port" : "514"
		}
	},

	"filters" : {
		"filter1" : "(${host}=='mymachine' || ${host}=='yourmachine') && ${appName}=='su'",
		"filter2" : "${client.address}=='192.168.135.49'",
		"fromUDP" : "${server.protocol}=='udp4'"
	},

	"filterGroups" : {
		"group1" : ["filter1","filter2"],
		"group2" : ["fromUDP","$group1"]
	},

	"transporters" : {
		"file" : {
			"type" : "file",
			"config" : {
				"format" : "${originalMessage}",
				"path" : "/var/log/${host}/${appName}/file.log"
			}
		},
		"debug" : {
			"type" : "console",
			"config" : {
				"level" : "log"
			}
		},
		"mongo" : {
			"type" : "mongo",
			"config" : {
				"host" : "localhost:27017",
				"db" : "syslog",
				"collection" : "${appName}",
				"schema" : {
					"host" : "${host}"
				}
			}
		}
	},

	"transporterGroups" : {
		"group1" : {"mode":"parallel", "transporters":["file","mongo"]},
		"group2" : {"mode":"serial", "transporters":["file","mongo"]}
	},

	"processors" : {
		"changeHeader" : {
			"type" : "replacer",
			"config" : {
				"host" : "${server.host}"
			}
		}
	},

	"flows" : [
		{"from":["filter1","$group2"], "transporters":["file","$group1"]},
		{"from":"DEFAULT", "transporters":["file"]},
		{"from":"*","transporters":["console"]}
	]
}