Information: Forum is in read-only mode
For details and other support options see

Removing the 32 char template limits for legacy format

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: alorbach

Google Ads

Removing the 32 char template limits for legacy format

Postby Themixeur » Wed Sep 06, 2017 3:19 pm

I'm using rsyslog to put some logs into a a postrgeSQL database, and I absolutly have to use the legacy format for template configuration (if I don't want to rewrite someone else entire conf file). My goal is to remove one of the limitations from the use of the current template.

Here's the template:
Code: Select all
$ModLoad ompgsql

$template customeTemplate, \
        "INSERT INTO eventrecorder( facility, severity, fromhostip, version, hostname, receivedat, devicereportedtime, appname, procid, msgid, message, structureddata) VALUES \
        ( '%syslogfacility%', '%syslogseverity%', '%fromhost-ip%', '%protocol-version%', '%hostname%', '%timegenerated:::date-rfc3339%', '%timereported:::date-rfc3339%','%app-name%', '%procid%', '%msgid%', '%msg%', '%structured-data%' );",  \

The limitation I'm refering to is the fact that if the %app-name% field is larger than 32 characters, the entire log entry is dismissed.

What I need to do is extend this limit to 48 characters and only truncate the field instead of removing the entire entry.

I found some things regarding the "regular" syntax like here :

But I haven't really found anything explaining the intricacies of transforming fields for the legacy format.

In the hopes you guys can help me.
Posts: 2
Joined: Wed Sep 06, 2017 1:21 pm

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Google Ads

Return to Configuration

Who is online

Users browsing this forum: No registered users and 0 guests