diff --git a/roles/log-collector/templates/rsyslog-collector.conf.j2 b/roles/log-collector/templates/rsyslog-collector.conf.j2 index d2c62fae210786b4b56d2ccdfb73a638f40f910a..7141f2edfc63aee94ab1335041c105df7ebc4132 100644 --- a/roles/log-collector/templates/rsyslog-collector.conf.j2 +++ b/roles/log-collector/templates/rsyslog-collector.conf.j2 @@ -58,7 +58,7 @@ template(name="lokiTemplate" constant(value="000000000") constant(value="\",\"") property(name="msg" format="json") constant(value="\"]]}") - } +} template(name="lokiTemplateHTTP" type="list" ) { constant(value="{") @@ -71,7 +71,7 @@ template(name="lokiTemplateHTTP" constant(value="000000000") constant(value="\",\"") property(name="$!all-json" position.from="2" format="jsonf") constant(value="\"]]}") - } +} template(name="lokiTemplateJSON" type="list" ) { constant(value="{") @@ -85,7 +85,6 @@ template(name="lokiTemplateJSON" property(outname="@timestamp" name="timereported" dateFormat="unixtimestamp" format="jsonf") constant(value="\",\"") property(name="$!all-json" position.from="2" format="jsonf") constant(value="\"]]}") - } } # Structured audit logs already contain a @timestamp field, so we # don't have to add our own. @@ -116,16 +115,6 @@ template(name="outfmt" type="list" option.jsonf="on") { name="app-name" format="jsonf") property(outname="message" name="msg" format="jsonf") - - } -{ - "@timestamp": "2018-03-01T01:00:00+00:00", - "host": "172.20.245.8", - "severity": "DEBUG", - "facility": "local4", - "syslog-tag": "app[1666]", - "source": "app", - "message": " this is my syslog message" } {% if enable_elasticsearch %}