Rsyslog omprog plugin, created to forward logs to Redis instance. Plugin writted in Golang.


License
Apache-2.0
Install
go get github.com/augustoliks/go-redis-rsyslog

Documentation

image image image Tests Release

gomprog

Rsyslog omprog plugin, created to forward logs to Redis instance. Plugin writted in Golang.

How install

  • Install:
curl https://raw.githubusercontent.com/augustoliks/gomprog/main/scripts/install.sh | sudo bash
  • Uninstall:
curl https://raw.githubusercontent.com/augustoliks/gomprog/main/scripts/uninstall.sh | sudo bash

Rsyslog Config

Configure file created for rsyslog in version 8.2010.0-1

# Incoming log from udp syslog
module(
  load="imudp"
)

# Import omprog, needded for fork gomprog binary
module(
  load="omprog"
)

# Define log template formatter GELF, compatible with gomprog handler
template(name="gelf" type="list") {
  constant(value="{\"_app_name\":\"")       property(name="app-name" caseconversion="lower")
  constant(value="\",\"host\":\"")          property(name="$myhostname")
  constant(value="\",\"short_message\":\"") property(name="msg" format="json")
  constant(value="\",\"timestamp\":")       property(name="timegenerated" dateformat="unixtimestamp")
  constant(value=",\"_group\":\"servers\"}\n")
}

# Import omprog, needded for fork gomprog binary
input(
  ruleset="main"
  type="imudp" 
  port="10514"  
)

# Define sub-ruleset to delivery logs, from imudp to gomprog binary (rsyslog omprog)
ruleset(name="main"){
  call gomprog
#  call plugin-foo
#  call ...
#  call plugin-bar
}

# Define sub-ruleset to delivery gomprog binary (rsyslog omprog)
ruleset(name="gomprog"){

  action(
    type="omprog"
    binary="gomprog-redis -n 127.0.0.1:6379 -p redis-password"
    template="gelf"
    action.resumeInterval="5" 
  #  output="/tmp/gomprog-debug.log"
  )

}

Tests

Download project

git clone https://github.com/augustoliks/gomprog
cd gomprog/

Provisioning redis instance

cd tests/
docker-compose up -d 

Configure Rsyslog

cp packaging/rsyslog.d/30-gomprog-redis.conf /etc/rsyslog.d/30-gomprog-redis.conf
systemctl restart rsyslog 

Log to upd using logger cli command

logger -d -n 127.0.0.1 -p 10514 "tests"

Access Redis container, subscribe _app_name channel

docker exec --user root -it redis bash                                                                                                           

root@e7d850092677:/data# redis-cli 

127.0.0.1:6379> SUBSCRIBE augustoliks
Reading messages... (press Ctrl-C to quit)
1) "subscribe"
2) "augustoliks"
3) (integer) 1
1) "message"
2) "augustoliks"
3) "{\"host\":\"localhost\",\"short_message\":\"tests\",\"timestamp\":1618719119,\"_group\":\"servers\",\"_app_name\":\"augustoliks\"}"

note:

augustoliks should be replace with Your Linux Username

Output expected

image

References