RSyslog Templates (template): event formation and transformation.

Overview.

Templates in RSyslog define in what form an event will be written to a file, sent to a remote server, or processed by another action.

Using templates you can change the structure of a Syslog message, select required fields, add constant values, modify HOSTNAME, form the message header, and use additional properties created during event processing.

Template example.

Let's consider forming a message in RFC 5424 format:

template(
   name="RemoteEvents"
   type="list"
) {
   constant(value="<")
   property(name="pri")
   constant(value=">1 ")
   property(
       name="timestamp"
       dateFormat="rfc3339"
   )
   constant(value=" ")
   property(name="hostname")
   constant(value="-nginx ")
   constant(value="nginx_access - - - ")
   property(name="msg")
   constant(value="\n")
}

As a result, a message of the following structure may be formed:

<PRI>1 TIMESTAMP HOSTNAME-nginx nginx_access - - - MESSAGE

For example:

<158>1 2026-09-21T10:00:00+05:00 server01-nginx nginx_access - - - <сообщение>

Main elements.

Using a template.

After declaration the template can be assigned to a specific action.

For example:

action(
    type="omfwd"
    target="192.168.0.200"
    port="514"
    protocol="tcp"
    template="RemoteEvents"
)

In this case, before sending to the remote server the event will be transformed according to the template RemoteEvents.

Template types.

RSyslog supports several template types. The choice depends on the task and the required output format.

Template list.

The template is formed from a sequence of property() and constant():

template(
    name="ExampleList"
    type="list"
) {
    property(name="timestamp")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    property(name="msg")
    constant(value="\n")
}

This approach is convenient for complex templates, because each field is described separately and the message structure is clearly visible in the configuration.

Template string.

Allows defining a template in a single line:

template(
    name="ExampleString"
    type="string"
    string="<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%\n"
)

Suitable for relatively simple text formats.

Other types.

RSyslog also supports other template types, in particular:

• type="subtree" — serialization of part of the structured data tree of the message;
• type="plugin" — generating the result using a specialized output plugin.

In addition, RSyslog provides built-in (reserved) templates for common Syslog formats.

The choice between list or string.

Templates list and string are the most widely used. Both types can be used in modern configurations. 

The string template represents a single-line template and is convenient for simple formats. The list template uses a more structured approach. For new and more complex configurations it is advisable to use the listtemplate, because this approach:

• explicitly separates event properties and constant values;
• simplifies reading and maintaining the configuration;
• allows individual customization of handling for specific properties;
• is more convenient when constructing complex structured messages;
• reduces the need to form long strings with substitutions %property%.

Template examples.

Link to the official RSyslog website with template examples:

Template examples