Thank you Deoren for your thoughts.  

I've seen some junk hostnames already appear in the logging directory. Thanks 
for your explanation. I can create an IP to Hostname table  like IP:HOSTNAME 
pairs, but unsure how rsyslog could use this to lookup the incoming IP address. 
 Is there a feature in rsyslog for this?

We cannot upgrade until we migrate from Solaris to the latest RHEL. Not on the 
cards,yet.  Planned for later.

The changelog link was very insightful.

Best wishes,

-----Original Message-----
From: rsyslog [] On Behalf Of deoren
Sent: Monday, February 19, 2018 4:49 PM
Subject: Re: [rsyslog] Forward messages from rsyslog server to JSON 
elasticSeach connector

On 2/19/2018 9:29 AM, sophie.loewenthal--- via rsyslog wrote:
> Hi,
> Does this configuration look ok begore I let this configuration rip in 
> production?
> A server running rsyslog 8.7.4 on Solaris 11 that receives TCP and UDP 
> messages from a mixture of syslog and rsyslog clients .
>   Each client has a %HOST.log created on the server file system.
> The rsyslog server forwards all those incoming messages into an ElasticSearch 
> via a JSON template server listening on a remote server on port 10514.
> The configuration I wrote successfully receives the UDP and TCP messages on 
> the server.
> Can anybody see any configuration there that could cause undue processing, or 
> errors. So far the testing has gone well.
> I've posted the configuration below.

Others can speak to specifics, but one word of warning regarding
expectations: %HOSTNAME% may sometimes have trash values if the remote sender 
doesn't properly format the message (or include reliable information).

We have a vulnerability scanner here that intentionally introduces bogus values 
and to override that behavior I've setup a lookup_table to map its source IP to 
a known value. Depending on your environment you may need to do something 
similar if you need to have reliable values in that field.

Two suggestions:

* If you run into problems it may be worth converting your configuration to use 
the current configuration syntax. That format has a lot of challenges that 
usually result in rsyslog not working as intended (directive order being just 

* Consider upgrading to a current version of rsyslog. I recall you mentioning 
on the forums that you've stuck using that version, but there have been a lot 
of changes since rsyslog 8.7 was released and you may encounter issues that 
have long since been fixed.

I recall you saying that you couldn't reach GitHub, so here is a copy of the 
Changelog from the dev's Git server:;a=blob_plain;f=ChangeLog;hb=HEAD
rsyslog mailing list
What's up with rsyslog? Follow NOTE WELL: This is 
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our 
This message and any attachments (the "message") is
intended solely for the intended addressees and is confidential. 
If you receive this message in error,or are not the intended recipient(s), 
please delete it and any copies from your systems and immediately notify
the sender. Any unauthorized view, use that does not comply with its purpose, 
dissemination or disclosure, either whole or partial, is prohibited. Since the 
cannot guarantee the integrity of this message which may not be reliable, BNP 
(and its subsidiaries) shall not be liable for the message if modified, changed 
or falsified. 
Do not print this message unless it is necessary, consider the environment.


Ce message et toutes les pieces jointes (ci-apres le "message") 
sont etablis a l'intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur ou s'il ne vous est pas destine,
merci de le detruire ainsi que toute copie de votre systeme et d'en avertir
immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de 
ce message qui n'est pas conforme a sa destination, toute diffusion ou toute 
publication, totale ou partielle, est interdite. L'Internet ne permettant pas 
l'integrite de ce message electronique susceptible d'alteration, BNP Paribas 
(et ses filiales) decline(nt) toute responsabilite au titre de ce message dans 
ou il aurait ete modifie, deforme ou falsifie. 
N'imprimez ce message que si necessaire, pensez a l'environnement.

rsyslog mailing list
What's up with rsyslog? Follow
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 

Reply via email to