Syslog (xm_syslog)

<Extension syslog>
    Module  xm_syslog
</Extension>

<Input file>
    Module  im_file

    # We monitor all files matching the wildcard.
    # Every line is read into the $raw_event field.
    File    "/var/log/app*.log"

    <Exec>
        # Set the $EventTime field usually found in the logs by
        # extracting it with a regexp. If this is not set, the current
        # system time will be used which might be a little off.
        if $raw_event =~ /(\d\d\d\d\-\d\d-\d\d \d\d:\d\d:\d\d)/
        {
            $EventTime = parsedate($1);
        }

        # Now set the severity to something custom. This defaults to
        # 'INFO' if unset.
        if $raw_event =~ /ERROR/ $Severity = 'ERROR';
        else $Severity = 'INFO';

        # The facility can be also set, otherwise the default value is
        # 'USER'.
        $SyslogFacility = 'AUDIT';

        # The SourceName field is called the TAG in RFC 3164
        # terminology and is usually the process name.
        $SourceName = 'my_application';

        # It is also possible to rewrite the Hostname if you do not
        # want to use the system hostname.
        $Hostname = 'myhost';

        # The Message field is used if present, otherwise the current
        # $raw_event is prepended with the Syslog headers. You can do
        # some modifications on the Message if required. Here we add
        # the full path of the source file to the end of message line.
        $Message = $raw_event + ' [' + file_name() + ']';

        # Now create our RFC 3164 compliant Syslog line using the
        # fields set above and/or use sensible defaults where
        # possible. The result will be in $raw_event.
        to_syslog_bsd();
    </Exec>
</Input>

<Output udp>
    # This module just sends the contents of the $raw_event field to
    # the destination defined here, one UDP packet per message.
    Module  om_udp
    Host    192.168.1.42:1514
</Output>

<Route file_to_udp>
    Path    file => udp
</Route>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input udp>
    Module      im_udp
    ListenAddr  0.0.0.0:514
    Exec        parse_syslog_bsd();
</Input>

<Output file>
    Module      om_file
    File        "/var/log/logmsg.txt"
</Output>

<Route syslog_to_file>
    Path        udp => file
</Route>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input ietf>
    Module      im_udp
    ListenAddr  0.0.0.0:514
    Exec        parse_syslog_ietf();
</Input>

<Output file>
    Module      om_file
    File        "/var/log/logmsg.txt"
</Output>

<Route ietf_to_file>
    Path        ietf => file
</Route>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input udp>
    Module      im_udp
    ListenAddr  0.0.0.0:514
    Exec        parse_syslog();
</Input>

<Output file>
    Module      om_file
    File        "/var/log/logmsg.txt"
</Output>

<Route syslog_to_file>
    Path        udp => file
</Route>

<Extension syslog>
    Module          xm_syslog
</Extension>

<Input ssl>
    Module          im_ssl
    ListenAddr      localhost:6514
    CAFile          %CERTDIR%/ca.pem
    CertFile        %CERTDIR%/client-cert.pem
    CertKeyFile     %CERTDIR%/client-key.pem
    KeyPass         secret
    InputType       Syslog_TLS
    Exec            parse_syslog_ietf();
</Input>

<Output file>
    Module          om_file
    File            "/var/log/logmsg.txt"
</Output>

<Route ssl_to_file>
    Path            ssl => file
</Route>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input file>
    Module      im_file
    File        "/var/log/input.txt"
    Exec        $TestField = "test value"; $Message = $raw_event;
</Input>

<Output tcp>
    Module      om_tcp
    Host        127.0.0.1:1514
    Exec        to_syslog_ietf();
    OutputType  Syslog_TLS
</Output>

<Route file_to_syslog>
    Path        file => tcp
</Route>

130 <13>1 2012-01-01T16:15:52.873750Z  - - - [NXLOG@14506 EventReceivedTime="2012-01-01 17:15:52" TestField="test value"] test message

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input udp>
    Module      im_udp
    ListenAddr  0.0.0.0:514
    Exec        parse_syslog_bsd();
</Input>

<Output file>
    Module      om_file
    File        "/var/log/logmsg.txt"
    Exec        if $Message =~ /error/ $SeverityValue = syslog_severity_value("error");
    Exec        to_syslog_bsd();
</Output>

<Route syslog_to_file>
    Path        udp => file
</Route>

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input udp>
    Module      im_udp
    ListenAddr  0.0.0.0:514
</Input>

<Processor rewrite>
    Module      pm_null
    <Exec>
        parse_syslog_bsd();
        if $Message =~ /error/
        {
            $SeverityValue = syslog_severity_value("error");
            to_syslog_bsd();
        }
    </Exec>
</Processor>

<Output file>
    Module      om_file
    File        "/var/log/logmsg.txt"
</Output>

<Route syslog_to_file>
    Path        udp => rewrite => file
</Route>