### Configuration file for rsyslog-pgsql ### Changes are preserved module (load="ompgsql") #came from package # *.* action(type="ompgsql" server="localhost" db="Syslog" uid="rsyslog" pwd="test") # Template for std PostgreSQL # $template pgsqlCombinedTemplate,"INSERT INTO logs (log_data) VALUES ('{\"timestamp\":\"%timereported:::date-rfc3339%\",\"message\":\"%msg:::json%\",\"host\":\"%hostname:::json%\",\"severity\":\"%syslogseverity-text:::json%\",\"facility\":\"%syslogfacility-text:::json%\",\"syslogtag\":\"%syslogtag:::json%\"}')",SQL # Template for TimescaleDB with index $template pgsqlCombinedTemplate,"INSERT INTO logs (timestamp, log_data) VALUES ('%timereported:::date-rfc3339%', '{\"timestamp\":\"%timereported:::date-rfc3339%\",\"message\":\"%msg:::json%\",\"host\":\"%hostname:::json%\",\"severity\":\"%syslogseverity-text:::json%\",\"facility\":\"%syslogfacility-text:::json%\",\"syslogtag\":\"%syslogtag:::json%\"}')",SQL # Save incoming logs to PostgreSQL DB with caching if $fromhost-ip != '127.0.0.1' then { action(type="ompgsql" server="localhost" user="logs_user" pass="logs_user_password" db="logs" template="pgsqlCombinedTemplate" queue.type="LinkedList" queue.size="10000" queue.workerThreads="2" queue.dequeueBatchSize="100" queue.highWatermark="8000" queue.lowWatermark="2000" queue.discardSeverity="0" queue.discardMark="9750") }