{"id":15022775,"url":"https://github.com/voxpupuli/puppet-rsyslog","last_synced_at":"2025-03-31T06:04:06.716Z","repository":{"id":8239873,"uuid":"56161879","full_name":"voxpupuli/puppet-rsyslog","owner":"voxpupuli","description":"Puppet module for managing rsyslog","archived":false,"fork":false,"pushed_at":"2024-09-16T19:02:29.000Z","size":620,"stargazers_count":10,"open_issues_count":22,"forks_count":53,"subscribers_count":40,"default_branch":"master","last_synced_at":"2024-10-29T14:22:42.296Z","etag":null,"topics":["centos-puppet-module","debian-puppet-module","fedora-puppet-module","hacktoberfest","linux-puppet-module","oraclelinux-puppet-module","puppet","redhat-puppet-module","scientific-puppet-module","ubuntu-puppet-module"],"latest_commit_sha":null,"homepage":"https://forge.puppet.com/puppet/rsyslog","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/voxpupuli.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"open_collective":"vox-pupuli","github":"voxpupuli"}},"created_at":"2016-04-13T15:02:27.000Z","updated_at":"2024-08-30T16:46:57.000Z","dependencies_parsed_at":"2023-07-12T14:57:15.826Z","dependency_job_id":"d1871b46-d8e6-42a6-8924-04c6c8884a8b","html_url":"https://github.com/voxpupuli/puppet-rsyslog","commit_stats":{"total_commits":351,"total_committers":32,"mean_commits":10.96875,"dds":0.811965811965812,"last_synced_commit":"40440a8adf609d824402dba2bcf4811b61e648c4"},"previous_names":["crayfishx/puppet-rsyslog"],"tags_count":32,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-rsyslog","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-rsyslog/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-rsyslog/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-rsyslog/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/voxpupuli","download_url":"https://codeload.github.com/voxpupuli/puppet-rsyslog/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246088895,"owners_count":20721782,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["centos-puppet-module","debian-puppet-module","fedora-puppet-module","hacktoberfest","linux-puppet-module","oraclelinux-puppet-module","puppet","redhat-puppet-module","scientific-puppet-module","ubuntu-puppet-module"],"created_at":"2024-09-24T19:58:22.256Z","updated_at":"2025-03-31T06:04:06.696Z","avatar_url":"https://github.com/voxpupuli.png","language":"Ruby","funding_links":["https://opencollective.com/vox-pupuli","https://github.com/sponsors/voxpupuli"],"categories":[],"sub_categories":[],"readme":"# puppet-rsyslog\n\n[![Build Status](https://img.shields.io/travis/voxpupuli/puppet-rsyslog/master.svg?style=flat-square)](https://travis-ci.org/voxpupuli/puppet-rsyslog)\n[![License](https://img.shields.io/github/license/voxpupuli/puppet-rsyslog.svg)](https://github.com/voxpupuli/puppet-rsyslog/blob/master/LICENSE)\n[![Puppet Forge](https://img.shields.io/puppetforge/v/puppet/rsyslog.svg?style=flat-square)](https://forge.puppetlabs.com/puppet/rsyslog)\n[![Puppet Forge](https://img.shields.io/puppetforge/dt/puppet/rsyslog.svg?style=flat-square)](https://forge.puppet.com/puppet/rsyslog)\n[![Puppet Forge](https://img.shields.io/puppetforge/e/puppet/rsyslog.svg?style=flat-square)](https://forge.puppet.com/puppet/rsyslog)\n[![Puppet Forge](https://img.shields.io/puppetforge/f/puppet/rsyslog.svg?style=flat-square)](https://forge.puppet.com/puppet/rsyslog)\n\n#### Table of Contents\n1. [Overview](#overview)\n2. [Module Description](#module-description)\n3. [Setup](#setup)\n    * [What this module affects](#what-this-module-affects)\n    * [Beginning with this module](#beginning-with-this-module)\n4. [Usage](#usage)\n    * [Rsyslog configuration directives](#rsyslog-configuration-directives)\n    * [Configuring objects](#configuring-objects)\n       * [Modules](#rsyslogconfigmodules)\n       * [Global configuration](#rsyslogconfigglobal_config)\n       * [Main queue options](#rsyslogconfigmain_queue_opts)\n       * [Templates](#rsyslogconfigtemplates)\n       * [Actions](#rsyslogconfigactions)\n       * [Inputs](#rsyslogconfiginputs)\n       * [Lookup_tables](#rsyslogconfiglookup_tables)\n       * [Parser](#rsyslogconfigparser)\n       * [Rulesets](#rsyslogconfigrulesets)\n       * [Filters](#rsyslogconfigproperty_filters)\n       * [legacy_config](#rsyslogconfiglegacy_config)\n    * [Positioning](#positioning)\n    * [Formatting](#formatting)\n5. [Known Issues](#known-issues)\n6. [License](#license)\n7. [Maintainer](#maintainer)\n\n## Overview\nThis module was first published as `crayfishx/rsyslog`.  It has now moved to `puppet/rsyslog` and is managed by the community group [Vox Pupuli](https://voxpupuli.org).\n\n## Module Description\n\nThis module manages the rsyslog server and client configuration. It supports rsyslog v8 and defaults to configuring most things in the newer rainerscript configuration style.  Where possible, common configuration patterns have been abstracted so they can be defined in a structured way from hiera.  Though there are a lot of customization options with the configuration, highly complex rsyslog configurations are not easily represented in simple data structures and in these circumstances you may have to provide raw rainerscript code to acheive what you need.  However, the aim of this module is to abstract as much as possible.\n\nThis module is only compatible with Puppet 4.0.0+\n\n## Setup\n\n### What this module affects\n\n* Installs the Rsyslog package, service, and configuration.\n* Install ancillary plugin packages.\n\n### Beginning with this module\n\nThis declaration will get you basic configuration for Rsyslog on your system:\n\n```puppet\ninclude rsyslog::config\n```\n\n## Usage\n\n### Rsyslog Configuration Directives\n\n#### Config file\n\nBy default, everything is configured in a single file under `$confdir` called 50_rsyslog.conf.  This means that packages and other OS specific configurations can also be included (see purge_config_files above).  The default file can be changed using the `rsyslog::target_file` directive and is relative to the confdir.\n\neg:\n\n```yaml\nrsyslog::target_file: 50_rsyslog.conf\n```\n\nYou can, however, define custom confdirs and/or custom paths for configuration files. All configuration options have the following global options you can add to their hiera keys:\n\n* `priority` - Order in the file to place the config value relative to the other config options in the file. Takes an integer. Defaults to the priority set for the configuration type. See [Ordering](#Ordering) for more.\n* `target` - Target file to place the config values in. Defaults to 50_rsyslog.conf in the default `$confdir`.\n* `confdir` - Target configuration directory. Defaults to `/etc/rsyslog.d`.\n\n##### Ordering\n\nThe following configuration parameters are defaults for the order of configuration object types within the configuration file.  They can be overriden for individual object definitions (see configuring objects below)\n\n```yaml\n## Default object type priorities (can be overridden)\nrsyslog::global_config_priority: 10\nrsyslog::module_load_priority: 20\nrsyslog::input_priority: 30\nrsyslog::main_queue_priority: 40\nrsyslog::parser_priority: 45\nrsyslog::template_priority: 50\nrsyslog::filter_priority: 55\nrsyslog::action_priority: 60\nrsyslog::ruleset_priority: 65\nrsyslog::lookup_table_priority: 70\nrsyslog::legacy_config_priority: 80\nrsyslog::custom_priority: 90\n```\n\nOrdering is done numerically. I.E. 111 is after 110 is after 99.\n\n### Configuring Objects\n\nConfiguration objects are written to the configuration file in rainerscript format and can be configured in a more abstract way directly from Hiera.     The following configuration object types are supported\n\n* [Modules](#rsyslogconfigmodules)\n* [Global configuration](#rsyslogconfigglobal_config)\n* [Main queue options](#rsyslogconfigmain_queue_opts)\n* [Templates](#rsyslogconfigtemplates)\n* [Actions](#rsyslogconfigactions)\n* [Inputs](#rsyslogconfiginputs)\n* [Lookup_tables](#rsyslogconfiglookup_tables)\n* [Parser](#rsyslogconfigparser)\n* [Rulesets](#rsyslogconfigrulesets)\n* [Filters](#rsyslogconfigproperty_filters)\n* [legacy_config](#rsyslogconfiglegacy_config)\n\n#### `rsyslog::config::modules`\n\nA hash of hashes, hash key represents the module name and accepts a hash with values or an empty hash as its value.\nThe hash accepts the following three values:\n\n* `type`: values can be `external or builtin` the default value is external and need not be specified explicitly.\n* `config`: its a hash which provides optional parameters to the module loaded.\n* `priority`: The module load order can be prioritised based on the optional `priority` value.\n\n\nPuppet example:\n```puppet\nclass { 'rsyslog::config':\n  modules =\u003e {\n    'imuxsock' =\u003e {},\n    'imudp' =\u003e {\n      'config' =\u003e {\n        'threads'     =\u003e '2',\n        'TimeRequery' =\u003e '8',\n        'batchSize'   =\u003e '128',\n      },\n    },\n    'omusrmsg' =\u003e {\n      'type' =\u003e 'builtin',\n    },\n    'omfile' =\u003e {\n      'type'   =\u003e 'builtin',\n      'config' =\u003e {\n        'fileOwner'      =\u003e 'syslog',\n        'fileGroup'      =\u003e 'adm',\n        'dirGroup'       =\u003e 'adm',\n        'fileCreateMode' =\u003e '0640',\n        'dirCreateMode'  =\u003e '0755',\n      },\n    },\n    'impstats' =\u003e {\n      'type'     =\u003e 'external',\n      'priority' =\u003e 29,\n      'config'   =\u003e {\n        'interval'   =\u003e '60',\n        'severity'   =\u003e '7',\n        'log.syslog' =\u003e 'off',\n        'log.file'   =\u003e '/var/log/rsyslog/logs/stats/stats.log',\n        'Ruleset'    =\u003e 'remote',\n      },\n    },\n  },\n}\n```\n\nHiera example:\n\n```yaml\nrsyslog::config::modules:\n  imuxsock: {}\n  imudp:\n    config:\n      threads: \"2\"\n      TimeRequery: \"8\"\n      batchSize: \"128\"\n  omusrmsg:\n    type: \"builtin\"\n  omfile:\n    type: \"builtin\"\n    config:\n      fileOwner: \"syslog\"\n      fileGroup: \"adm\"\n      dirGroup: \"adm\"\n      fileCreateMode: \"0640\"\n      dirCreateMode: \"0755\"\n  impstats:\n    type: \"external\"\n    priority: 29\n    config:\n      interval: \"60\"\n      severity: \"7\"\n      log.syslog: \"off\"\n      log.file: \"/var/log/rsyslog/logs/stats/stats.log\"\n      Ruleset: \"remote\"\n```\n\nwill produce\n\n```\nmodule (load=\"imuxsock\")\nmodule (load=\"imudp\"\n           threads=\"2\"\n           TimeRequery=\"8\"\n           batchSize=\"128\"\n\n)\nmodule (load=\"builtin:omusrmsg\")\nmodule (load=\"builtin:omfile\"\n           fileOwner=\"syslog\"\n           fileGroup=\"adm\"\n           dirGroup=\"adm\"\n           fileCreateMode=\"0640\"\n           dirCreateMode=\"0755\"\n\n)\nmodule (load=\"impstats\"\n           interval=\"60\"\n           severity=\"7\"\n           log.syslog=\"off\"\n           log.file=\"/var/log/rsyslog/logs/stats/stats.log\"\n           Ruleset=\"remote\"\n\n)\n```\n\n##### `rsyslog::config::global_config`\n\nA hash of hashes, they key represents the configuration setting and the value is a hash with the following keys:\n\n* `value`: the value of the setting\n* `type`: the type of format to use (legacy or rainerscript), if omitted rainerscript is used.\n\nPuppet example:\n```puppet\nclass { 'rsyslog::config':\n  global_config =\u003e {\n    'umask' =\u003e {\n      'value'    =\u003e '0000',\n      'type'     =\u003e 'legacy',\n      'priority' =\u003e 01,\n    },\n    'RepeatedMsgReduction' =\u003e {\n      'value' =\u003e 'on',\n      'type'  =\u003e 'legacy',\n    },\n    'PrivDropToUser' =\u003e {\n      'value' =\u003e 'syslog',\n      'type'  =\u003e 'legacy',\n    },\n    'PrivDropToGroup' =\u003e {\n      'value' =\u003e 'syslog',\n      'type'  =\u003e 'legacy',\n    },\n    'parser.escapeControlCharactersOnReceive' =\u003e {\n      'value' =\u003e 'on',\n    },\n    'workDirectory' =\u003e {\n      'value' =\u003e '/var/spool/rsyslog',\n    },\n    'maxMessageSize' =\u003e {\n      'value' =\u003e '64k',\n    },\n  },\n}\n```\n\nHiera example:\n```yaml\nrsyslog::config::global_config:\n  umask:\n    value: '0000'\n    type: legacy\n    priority: 01\n  RepeatedMsgReduction:\n    value: 'on'\n    type: legacy\n  PrivDropToUser:\n    value: 'syslog'\n    type: legacy\n  PrivDropToGroup:\n    value: 'syslog'\n    type: legacy\n  parser.escapeControlCharactersOnReceive:\n    value: 'on'\n  workDirectory:\n    value: '/var/spool/rsyslog'\n  maxMessageSize:\n    value: '64k'\n```\n\nwill produce\n\n```\n$umask 0000\n$PrivDropToGroup syslog\n$PrivDropToUser syslog\n$RepeatedMsgReduction on\nglobal (\n    parser.escapeControlCharactersOnReceive=\"on\"\n    workDirectory=\"/var/spool/rsyslog\"\n    maxMessageSize=\"64k\"\n)\n```\n\n##### `rsyslog::config::main_queue_opts`\n\nConfigures the `main_queue` object in rsyslog as a hash. eg:\n\nPuppet Example:\n```puppet\nclass { 'rsyslog::config':\n  main_queue_opts =\u003e {\n    'queue.maxdiskspace'     =\u003e '1000G',\n    'queue.dequeuebatchsize' =\u003e 1000,\n  }\n}\n```\n\nHiera Example:\n```yaml\nrsyslog::config::main_queue_opts:\n  queue.maxdiskspace: 1000G\n  queue.dequeuebatchsize: 1000\n```\n\nwill produce\n\n```\nmain_queue(\n  queue.maxdiskspace=\"1000G\"\n  queue.dequeuebatchsize=\"1000\"\n)\n```\n\n##### `rsyslog::config::templates`\n\nConfigures `template` objects in rsyslog.  Each element is a hash containing the name of the template, the type and the template data.    The type parameter can be one of `string`, `subtree`, `plugin` or `list`\n\nPuppet Example:\n\n```puppet\nclass { 'rsyslog::config':\n  templates =\u003e {\n    'remote' =\u003e {\n      'type'   =\u003e 'string',\n      'string' =\u003e '/var/log/rsyslog/logs/%fromhost-ip%.log',\n    },\n    'tpl2' =\u003e {\n      'type'    =\u003e 'subtree',\n      'subtree' =\u003e '$1!$usr',\n    },\n    'someplug' =\u003e {\n      'type'   =\u003e 'plugin',\n      'plugin' =\u003e 'foobar',\n    },\n  }\n}\n```\n\nHiera Example:\n\n```yaml\nrsyslog::config::templates:\n  remote:\n    type: string\n    string: \"/var/log/rsyslog/logs/%fromhost-ip%/%fromhost-ip%.log\"\n  tpl2:\n    type: subtree\n    subtree: \"$1!$usr\"\n  someplug:\n     type: plugin\n     plugin: foobar\n```\n\nwill produce\n\n```\ntemplate (name=\"remote\" type=\"string\"\n  string=\"/var/log/rsyslog/logs/%fromhost-ip%/%fromhost-ip%.log\"\n)\n```\n\nWhen using `list`, the `list_descriptions` hash should contain an array of single element hashes, the key should be `constant` or `property` with their corresponding parameters in a sub hash.\n\nPuppet example:\n\n```puppet\nclass { 'rsyslog::config':\n  templates =\u003e {\n    'plain-syslog' =\u003e {\n      'type' =\u003e 'list',\n      'list_descriptions' =\u003e [\n        {\n          'constant' =\u003e {\n            'value' =\u003e '{',\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\"@timestamp\\\":\\\"',\n          }\n        },\n        {\n          'propery' =\u003e {\n            'name' =\u003e 'timereported',\n            'dateFormat' =\u003e 'rfc3339',\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\",\\\"host\\\":\\\"'\n          }\n        },\n        {\n          'property' =\u003e {\n            'name' =\u003e 'hostname'\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\",\\\"severity\\\":\\\"'\n          }\n        },\n        {\n          'property' =\u003e {\n            'name' =\u003e 'syslogseverity-text',\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\",\\\"facility\\\":\\\"'\n          }\n        },\n        {\n          'property' =\u003e {\n            'name' =\u003e 'syslogfacility-text'\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\",\\\"host\\\":\\\"'\n          }\n        },\n        {\n          'property' =\u003e {\n            'name'   =\u003e 'syslogtag',\n            'format' =\u003e 'json',\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\",\\\"message\\\":\\\"'\n          }\n        },\n        {\n          'property' =\u003e {\n            'name'   =\u003e 'msg',\n            'format' =\u003e 'json'\n          }\n        },\n        {\n          'constant' =\u003e {\n            'value' =\u003e '\\\"}'\n          }\n        }\n      ]\n    }\n  }\n}\n```\n\nHiera example:\n\n```yaml\n  plain-syslog:\n    type: list\n    list_descriptions:\n      - constant:\n          value: '{'\n      - constant:\n          value: '\\\"@timestamp\\\":\\\"'\n      - property:\n         name: timereported\n         dateFormat: rfc3339\n      - constant:\n         value: '\\\",\\\"host\\\":\\\"'\n      - property:\n         name: hostname\n      - constant:\n         value: '\\\",\\\"severity\\\":\\\"'\n      - property:\n         name: syslogseverity-text\n      - constant:\n         value: '\\\",\\\"facility\\\":\\\"'\n      - property:\n         name: syslogfacility-text\n      - constant:\n         value: '\\\",\\\"tag\\\":\\\"'\n      - property:\n         name: syslogtag\n         format: json\n      - constant:\n         value: '\\\",\\\"message\\\":\\\"'\n      - property:\n         name: msg\n         format: json\n      - constant:\n         value: '\\\"}'\n```\n\nwill produce\n\n```\ntemplate (name=\"plain-syslog\" type=\"list\"\n)\n{\n    constant(value=\"{\" )\n    constant(value=\"\\\"@timestamp\\\":\\\"\" )\n    property(name=\"timereported\" dateFormat=\"rfc3339\" )\n    constant(value=\"\\\",\\\"host\\\":\\\"\" )\n    property(name=\"hostname\" )\n    constant(value=\"\\\",\\\"severity\\\":\\\"\" )\n    property(name=\"syslogseverity-text\" )\n    constant(value=\"\\\",\\\"facility\\\":\\\"\" )\n    property(name=\"syslogfacility-text\" )\n    constant(value=\"\\\",\\\"tag\\\":\\\"\" )\n    property(name=\"syslogtag\" format=\"json\" )\n    constant(value=\"\\\",\\\"message\\\":\\\"\" )\n    property(name=\"msg\" format=\"json\" )\n    constant(value=\"\\\"}\" )\n}\n\n```\n\n##### `rsyslog::config::actions`\n\nConfigures action objects in rainerscript.  Each element of the hash contains the type of action, followed by a hash of configuration options.\nIt also accepts an optional facility parameter and the content is formatted based on the no of config options passed and if the facility option is present.\n\nPuppet example:\n\n```puppet\nclass { 'rsyslog::config':\n  actions =\u003e {\n    'all_logs' =\u003e {\n      'type'     =\u003e 'omfile',\n      'facility' =\u003e '*.*;auth,authpriv.none',\n      'config'   =\u003e {\n        'dynaFile'  =\u003e 'remoteSyslog',\n        'specifics' =\u003e '/var/log/test',\n      }\n    },\n    'kern_logs' =\u003e {\n      'type'     =\u003e 'omfile',\n      'facility' =\u003e 'kern.*',\n      'config'   =\u003e {\n        'dynaFile' =\u003e 'remoteSyslog',\n        'file'     =\u003e '/var/log/kern.log',\n        'cmd'      =\u003e '/proc/cmdline',\n      }\n    },\n    'elasticsearch' =\u003e {\n      'type'   =\u003e 'omelasticsearch',\n      'config' =\u003e {\n        'queue.type'           =\u003e 'linkedlist',\n        'queue.spoolDirectory' =\u003e '/var/log/rsyslog/queue'\n      }\n    }\n  }\n}\n```\n\nHiera example:\n\n```yaml\nrsyslog::config::actions:\n  all_logs:\n    type: omfile\n    facility: \"*.*;auth,authpriv.none\"\n    config:\n      dynaFile: \"remoteSyslog\"\n      specifics: \"/var/log/test\"\n  kern_logs:\n    type: omfile\n    facility: \"kern.*\"\n    config:\n      dynaFile: \"remoteSyslog\"\n      file: \"/var/log/kern.log\"\n      cmd: \"/proc/cmdline\"\n  elasticsearch:\n    type: omelasticsearch\n    config:\n      queue.type: \"linkedlist\"\n      queue.spoolDirectory: /var/log/rsyslog/queue\n```\n\nwill produce\n\n```\n#Note: There is only 2 options passed so formats in a single line.\n# all_logs\n*.*;auth,authpriv.none         action(type=\"omfile\" dynaFile=\"remoteSyslog\" specifics=\"/var/log/test\" )\n\n#Note: There is more than 2 options passed so formats into multi line with facility.\n# kern_logs\nkern.*                         action(type=\"omfile\"\n                                 dynaFile=\"remoteSyslog\"\n                                 file=\"/var/log/kern.log\"\n                                 cmd=\"/proc/cmdline\"\n                               )\n\n#Note: There is no facility option passed so formats it without facility.\naction(type=\"omelasticsearch\"\n  queue.type=\"linkedlist\"\n  queue.spoolDirectory=\"/var/log/rsyslog/queue\"\n)\n```\n\n##### `rsyslog::config::inputs`\n\nConfigures input objects in rainerscript.  Each element of the hash contains the type of input, followed by a hash of configuration options. Eg:\n\nPuppet examples:\n\n```puppet\nclass { 'rsyslog:config':\n  inputs =\u003e {\n    'imudp' =\u003e {\n      'type'   =\u003e 'imudp',\n      'config' =\u003e {\n        'port' =\u003e '514'\n      }\n    }\n  }\n}\n```\n\nHiera examples:\n\n```yaml\nrsyslog::config::inputs:\n  imudp:\n    type: imudp\n    config:\n      port: '514'\n```\n\nwill produce\n\n```\n# imdup\ninput(type=\"imudp\"\n  port=\"514\"\n)\n```\n\n##### `rsyslog::config::lookup_tables`\n\nConfigures lookup_tables objects in rainerscript AND generates the JSON lookup_table file. Each key of the hash contains the name of the lookup/lookup_table.\nThe elements of the hash contain a `json` hash containing the values for the JSON file, a lookup_file element that is the path to where the JSON file will be stored,\nand a reload_on_hup boolean.\n\nThe json hash contains 4 elements: `version`, `nolookup`, `type`, and `table`. They **MUST** be specified in this order as per the\n[lookup_tables documentation](http://www.rsyslog.com/doc/v8-stable/configuration/lookup_tables.html):\n\n* `version` - Integer denoting the version/revision of the lookup_table file.\n* `nolookup` - String denoting what should be returned if a lookup doesn't find a match in the table.\n* `type` - Enumerable denoting the type of lookup table. This can be `string`, `array`, or `sparseArray`.\n* `table` - An Array of hashes containing the table index and value for each lookup.\n\nPuppet example:\n\n```puppet\nclass { 'rsyslog::config':\n  lookup_tables =\u003e {\n    'ip_lookup' =\u003e {\n      'lookup_json' =\u003e {\n        'version'  =\u003e 1,\n        'nolookup' =\u003e 'unk',\n        'type'     =\u003e 'string',\n        'table'    =\u003e [\n          {\n            'index' =\u003e '1.1.1.1',\n            'value' =\u003e 'AB'\n          },\n          {\n            'index' =\u003e '2.2.2.2',\n            'value' =\u003e 'CD'\n          }\n        ]\n      },\n      'lookup_file'   =\u003e '/etc/rsyslog.d/tables/ip_lookup.json',\n      'reload_on_hup' =\u003e true\n    }\n  }\n}\n```\n\nHiera Example:\n\n```yaml\nrsyslog::config::lookup_tables:\n  ip_lookup:\n    lookup_json:\n      version: 1\n      nolookup: 'unk'\n      type: 'string'\n      table:\n        - index: '1.1.1.1'\n          value: 'AB'\n        - index: '2.2.2.2'\n          value: 'CD'\n    lookup_file: '/etc/rsyslog.d/tables/ip_lookup.json'\n    reload_on_hup: true\n```\n\nwill produce\n\n```json\n# /etc/rsyslog.d/tables/ip_lookup.json\n{\n  \"version\": 1,\n  \"nomatch\": \"unk\",\n  \"type\": \"string\",\n  \"table\": [\n    {\n      \"index\": \"1.1.1.1\",\n      \"value\": \"A\"\n    },\n    {\n      \"index\": \"2.2.2.2\",\n      \"value\": \"B\"\n    }\n  ]\n}\n```\n\nand\n\n```\nlookup_table(name=\"ip_lookup\" file=\"/etc/rsyslog.d/tables/ip_lookup.json\" reloadOnHUP=\"on\")\n```\n\nNOTE: This does not create the actual `lookup()` call in the Rsyslog configuration file(s). Currently that is only supported via\nthe `rsyslog::config::custom_config` hash as it requires setting rsyslog variables (I.E. - `set $.iplook = lookup('ip_lookup', $hostname)`).\n\n##### `rsyslog::config::parser`\n\nConfigures parser objects in rainerscript. Each Element of the hash contains the type of parser, followed by a hash of configuration options. Eg:\n\nPuppet Example:\n\n```puppet\nclass { 'rsyslog::config':\n  parser =\u003e {\n    'pmrfc3164_hostname_with_slashes' =\u003e {\n      'type'   =\u003e 'pmrfc3164',\n      'config' =\u003e {\n        'permit.slashesinhostname' =\u003e 'on'\n      }\n    }\n  }\n}\n```\n\nHiera Example:\n\n```yaml\nrsyslog::config::parser:\n  pmrfc3164_hostname_with_slashes:\n    type: pmrfc3164\n    config:\n      permit.slashesinhostname: 'on'\n```\n\nwill produce\n\n```\nparser(name=\"pmrfc3164_hostname_with_slashes\"\n       type=\"pmrfc3164\"\n       permit.slashesinhostname=\"on\"\n)\n```\n\n##### `rsyslog::config::rulesets`\n\nConfigures Rsyslog ruleset blocks in rainerscript. There are two elements in the rulesets hash:\n\n* `parameters` - settings to pass to the ruleset determining things such as which rsyslog parser to use or the ruleset's queue size.\n* `rules` - the actual content that goes inside the ruleset. Currently the following are supported:\n  * `action` - rsyslog actions defined inside of the ruleset.\n  * `lookup` - Sets a variable to the results of an rsyslog lookup.\n  * `set` - Set an rsyslog variable or property. Property explicitly requires that the set name be a string beginning with `$!`, while a variable can be a plain string or a string starting with `$.`.\n    * **NOTE: Setting the variable with a string that does NOT begin with `$.` is deprecated and will be removed in the next major release!**\n  * `call` - call a specific action.\n  * `exec` - execute the following system command\n  * `expression_filter` - Filter based on one or more expressions.\n  * `property_filter` - Filter based on one or more RsyslogD properties.\n* `stop` - a Boolean to set if the ruleset ends with a stop or not.\n\n**NOTE: For any `rule` key that can also be a standalone rsyslog resource (`action`, `expression_filter`, or `property_filter`), the user MUST define a name key that will be passed as the resource name to the template. This will be simplified in a future release.**\n\n**NOTE: While it is entirely possible to configure Rulesets using the Puppet DSL, it is recommended against as Rulesets can easily become difficult to read when compared to the YAML-based hieradata.**\n\nPuppet example:\n\n```puppet\nclass { 'rsyslog::config':\n  rulesets =\u003e {\n    'ruleset_eth0_514_tcp' =\u003e {\n      'parameters' =\u003e {\n        'parser'     =\u003e 'pmrfc3164.hostname_with_slashes',\n        'queue.size' =\u003e '10000',\n      },\n      'rules' =\u003e [\n        { 'set' =\u003e { '$!rcv_time'  =\u003e 'exec_template(\"s_rcv_time\")' }},\n        { 'set' =\u003e { '$.utime_gen' =\u003e 'exec_template(\"s_unixtime_generated\")' }},\n        { 'set' =\u003e { 'uuid'        =\u003e '$uuid' }},\n        {\n          'action' =\u003e {\n            'name' =\u003e 'utf8-fix',\n            'type' =\u003e 'mmutf8fix',\n          }\n        },\n        {\n          'action' =\u003e {\n            'name'     =\u003e 'test-action',\n            'type'     =\u003e 'omfile',\n            'facility' =\u003e '*.*;auth,authpriv.none',\n            'config'   =\u003e {\n              'dynaFile'  =\u003e 'remoteSyslog',\n              'specifics' =\u003e '/var/log/test'\n            }\n          }\n        },\n        {\n          'action' =\u003e {\n            'name'   =\u003e 'test-action2',\n            'type'   =\u003e 'omfile',\n            'config' =\u003e {\n              'dynaFile'  =\u003e 'remoteSyslog',\n              'specifics' =\u003e '/var/log/test'\n            }\n          }\n        },\n        {\n          'lookup' =\u003e {\n            'var'          =\u003e 'srv',\n            'lookup_table' =\u003e 'srv-map',\n            'expr'         =\u003e '$fromhost-ip'\n          }\n        },\n        { 'call' =\u003e 'action.parse.rawmsg' },\n        { 'call' =\u003e 'action.parse.r_msg' },\n      ],\n      'stop' =\u003e true,\n    }\n  }\n}\n```\n\nHiera example:\n\n```yaml\nrsyslog::config::rulesets:\n  ruleset_eth0_514_tcp:\n    parameters:\n      parser: pmrfc3164.hostname_with_slashes\n      queue.size: '10000'\n    rules:\n      - set:\n          # Set a Property with a value from a template.\n          $!rcv_time: 'exec_template(\"s_rcv_time\")'\n      - set:\n          # Set a Variable with a value from a template.\n          $.utime_gen: 'exec_template(\"s_unixtime_generated\")'\n      - set:\n          # Set a Variable using the deprecated method with a value from $uuid\n          uuid: '$uuid'\n      - action:\n          name: utf8-fix\n          type: mmutf8fix\n      - action:\n          name: test-action\n          type: omfile\n          facility: \"*.*;auth,authpriv.none\"\n          config:\n            dynaFile: \"remoteSyslog\"\n            specifics: \"/var/log/test\"\n      - action:\n          name: test-action2\n          type: omfile\n          config:\n            dynaFile: \"remoteSyslog\"\n            specifics: \"/var/log/test\"\n      - lookup:\n          var: srv\n          lookup_table: srv-map\n          expr: '$fromhost-ip'\n      - call: 'action.parse.rawmsg'\n      - call: 'action.parse.r_msg'\n      - exec: '/bin/echo'\n    stop: true\n```\n\nWill produce:\n\n```\nruleset (name=\"ruleset_eth0_514_tcp\"\n  parser=\"pmrfc3164.hostname_with_slashes\"\n  queue.size=\"10000\"\n) {\n  set $.rcv_time = exec_template(\"s_rcv_time\");\n  set $.utime_gen = exec_template(\"s_unixtime_generated\");\n  set $.uuid = $uuid;\n  # utf8-fix action\n  action(type=\"mmutf8fix\"\n    name=\"utf8-fix\"\n  )\n  # test-action action\n*.*;auth,authpriv.none         action(type=\"omfile\"\n                                 name=\"test-action\"\n                                 dynaFile=\"remoteSyslog\"\n                                 specifics=\"/var/log/test\"\n                               )\n  # test-action2 action\n  action(type=\"omfile\"\n    name=\"test-action2\"\n    dynaFile=\"remoteSyslog\"\n    specifics=\"/var/log/test\"\n  )\n  set $.srv = lookup(\"srv-map\", $fromhost-ip);\n  call action.parse.rawmsg\n  call action.parse.r_msg\n  ^/bin/echo\n  stop\n}\n\n```\n\nRulesets can also contain filtering logic for calling other rulesets, setting other variables, or even dropping logs based on specific values. Filtering logic is required to utilize `lookup_tables` and `lookup` calls.\n\nRsyslog puppet supports two kinds of filters:\n\n* `expression_filter`\n* `property_filter`\n\nMore information about Rsyslog Filters can be found at: http://www.rsyslog.com/doc/v8-stable/configuration/filters.html\n\n###### Ruleset Expression Filter\n\nExpression filters use traditional `if/else` and `if/else if/else` logic to execute rules on specific return values. `lookup_tables` are compatible ONLY with `expression_filters`\n\nThe Ruleset `expression_filter` key has a few different keys than the `rsyslog::config::expression_filters` parameter:\n\n* `name` - Currently required to prevent errors. This is logical and only used by Puppet.\n* `filter` - The `filter` key is synonymous with the `conditionals` key found in the `rsyslog::config::expression_filters` parameter. See the [Expression Filter Docs](#expression-based-filters) for more info.\n\nPuppet Example:\n\n```puppet\nclass { 'rsyslog::config':\n  rulesets =\u003e {\n    'ruleset_eth0_514_udp' =\u003e {\n      'parameters' =\u003e {\n        'queue.type' =\u003e 'LinkedList'\n      },\n      'rules' =\u003e [\n        {\n          'expression_filter' =\u003e {\n            'filter' =\u003e {\n              'if' =\u003e {\n                'expression' =\u003e '$fromhost-ip == \"192.168.255.1\"',\n                'tasks' =\u003e [\n                  { 'call' =\u003e 'ruleset.action.rawlog.standard' },\n                  { 'stop' =\u003e true }\n                ]\n              }\n            }\n          }\n        },\n        { 'call' =\u003e 'ruleset.client.log.standard' },\n        { 'call' =\u003e 'ruleset.unknown.standard' },\n      ],\n      'stop' =\u003e true\n    }\n  }\n}\n```\n\nHiera Example:\n```yaml\nrsyslog::config::rulesets:\n  ruleset_eth0_514_udp:\n    parameters:\n      queue.type: LinkedList\n    rules:\n      - expression_filter:\n          filter:\n            if:\n              expression: '$fromhost-ip == \"192.168.255.1\"'\n              tasks:\n                - call: \"ruleset.action.rawlog.standard\"\n                - stop: true\n      - call: \"ruleset.client.log.standard\"\n      - call: \"ruleset.unknown.standard\"\n    stop: true\n```\n\nwill produce:\n\n```\nruleset (name=\"ruleset_eth0_514_tcp\"\n  queue.type=\"LinkedList\"\n) {\n  if $fromhost-ip == \"192.168.255.1\" then {\n    call ruleset.action.rawlog.standard\n    stop\n  }\n  call ruleset.client.log.standard\n  call ruleset.unknown.standard\n  stop\n}\n```\n\nPuppet example with lookup tables:\n*NOTE: Good example for how to define multiple rsyslog resources in a single `rsyslog::config` class*\n```puppet\nclass { 'rsyslog::config':\n  lookup_tables =\u003e {\n    'srv-map' =\u003e {\n      'lookup_json'   =\u003e {\n        'version'  =\u003e 1,\n        'nolookup' =\u003e 'unk',\n        'type'     =\u003e 'string',\n        'table'    =\u003e [\n          {\n            'index' =\u003e '192.168.255.10',\n            'value' =\u003e 'windows'\n          },\n          {\n            'index' =\u003e '192.168.255.11',\n            'value' =\u003e 'windows'\n          },\n          {\n            'index' =\u003e '192.168.255.12',\n            'value' =\u003e 'linux'\n          }\n        ],\n      },\n      'lookup_file'   =\u003e '/etc/rsyslog.d/tables/srv-map.json',\n      'reload_on_hup' =\u003e true\n    }\n  },\n  rulesets =\u003e {\n    'ruleset_lookup_set_windows_by_ip' =\u003e {\n      'rules' =\u003e [\n        {\n          'lookup' =\u003e {\n            'var'          =\u003e 'srv',\n            'lookup_table' =\u003e 'srv-map',\n            'expr'         =\u003e '$fromhost-ip'\n          }\n        },\n        {\n          'expression_filter' =\u003e {\n            'filter' =\u003e {\n              'main' =\u003e {\n                'expression' =\u003e '$.srv == \\\"windows\\\"',\n                'tasks' =\u003e [\n                  { 'call' =\u003e 'ruleset.action.forward.windows' },\n                  { 'stop' =\u003e true }\n                ]\n              },\n              'unknown_log' =\u003e {\n                'expression' =\u003e '$.srv == \\\"unk\\\"',\n                'tasks' =\u003e [\n                  { 'call' =\u003e 'ruleset.action.drop.unknown' },\n                  { 'stop' =\u003e 'true' }\n                ]\n              },\n              'default' =\u003e {\n                'tasks' =\u003e [\n                  { 'stop' =\u003e 'true' }\n                ]\n              }\n            }\n          }\n        }\n      ]\n    }\n  }\n}\n```\n\nExample with lookup:\n```yaml\nrsyslog::config::lookup_tables:\n  srv-map:\n    lookup_json:\n      version: 1\n      nolookup: 'unk'\n      type: 'string'\n      table:\n        - index: '192.168.255.10'\n          value: 'windows'\n        - index: '192.168.255.11'\n          value: 'windows'\n        - index: '192.168.255.12'\n          value: 'linux'\n    lookup_file: '/etc/rsyslog.d/tables/srv-map.json'\n    reload_on_hup: true\nrsyslog::config::rulesets:\n  ruleset_lookup_set_windows_by_ip:\n    rules:\n      - lookup:\n          var: srv\n          lookup_table: srv-map\n          expr: '$fromhost-ip'\n      - expression_filter:\n          filter:\n            main:\n              expression: '$.srv == \"windows\"'\n              tasks:\n                - call: \"ruleset.action.forward.windows\"\n                - stop: true\n            unknown_log:\n              expression: '$.srv == \"unk\"'\n              tasks:\n                - call: \"ruleset.action.drop.unknown\"\n                - stop: true\n            default:\n              tasks:\n                - stop: true\n    stop: true\n```\n\nWill produce:\n\n```json\n#/etc/rsyslog.d/tables/srv-map.json\n{\n  \"version\": 1,\n  \"nomatch\": \"unk\",\n  \"type\": \"string\",\n  \"table\": [\n    {\n      \"index\": \"192.168.255.10\",\n      \"value\": \"windows\"\n    },\n    {\n      \"index\": \"192.168.255.11\",\n      \"value\": \"windows\"\n    },\n    {\n      \"index\": \"192.168.255.12\",\n      \"value\": \"linux\"\n    }\n  ]\n}\n```\n\n```\n#rsyslog.conf\nlookup_table(name=\"srv-map\" file=\"/etc/rsyslog.d/tables/srv-map.json\" reloadOnHUP=on)\n\nruleset(name=\"ruleset_lookup_set_windows_by_ip\"\n) {\n  set $.srv = lookup(\"srv-map\", $fromhost-ip);\n  if ($.srv == \"windows\") then {\n    call ruleset.action.forward.windows\n    stop\n  } else if ($.srv == \"unk\") then {\n    call ruleset.action.drop.unknown\n    stop\n  } else {\n    stop\n  }\n}\n```\n\n###### Ruleset Property Filters\n\n`property_filters` are unique to rsyslogd. They allow to filter on any property, like HOSTNAME, syslogtag and msg. `property_filters` are faster than `expression_filters` as they us built-in rsyslog properties to lookup and match data.\n\nPuppet Example:\n```puppet\nclass { 'rsyslog::config':\n  rulesets =\u003e {\n    'ruleset_msg_check_for_error' =\u003e {\n      'rules' =\u003e [\n        {\n          'property_filter' =\u003e {\n            'property' =\u003e 'msg',\n            'operator' =\u003e 'contains',\n            'value'    =\u003e 'error',\n            'tasks'    =\u003e [\n              { 'call' =\u003e 'ruleset.action.error' },\n              { 'stop' =\u003e true }\n            ]\n          }\n        }\n      ]\n    }\n  }\n}\n```\n\nHiera Example:\n```yaml\nrsyslog::config::rulesets:\n  ruleset_msg_check_for_error:\n    rules:\n      - property_filter:\n          property: 'msg'\n          operator: 'contains'\n          value: 'error'\n          tasks:\n            - call: 'ruleset.action.error'\n            - stop: true\n```\n\nWill Generate:\n\n```\n#rsyslog.conf\nruleset(name=\"ruleset_msg_check_for_error\"\n) {\n  :msg, contains, \"informational\" {\n    call ruleset.action.error\n    stop\n  }\n}\n```\n\n##### `rsyslog::config::property_filters`\n\nRsyslog has the ability to filter each log line based on log properties and/or variables.\n\nThere are four kinds of filters in Rsyslog:\n\n* \"traditional\" severity/facility based Selectors - handled in the [Actions](#rsyslogconfigactions) parameter.\n* BSD-style blocks - not supported in Rsyslog 7+ and as such are not supported in this module.\n* Property-based Filters\n* Expression-based Filters\n\nThis section covers Property and Expression based filters.\n\n###### Property-based Filters\n\nProperty-based filters are unique to rsyslogd. They allow to filter on any property, like HOSTNAME, syslogtag and msg.\nProperty-based filters are only supported with native properties in Rsyslog. See [Rsyslog Properties](http://www.rsyslog.com/doc/v8-stable/configuration/property_replacer.html) for a list of supported properties.\n\nThe `rsyslog::config::property_filters` parameter is a Hash of hashes where the hash-key is the logical name for the filter. This name is for Puppet resource naming purposes only and has no other function. The filter name has several additional child keys as well:\n\n* `property` - the Rsyslogd property the filter will lookup.\n* `operator` - the Rsyslogd property filter-supported operator to compare the property value with the expected value. See [Rsyslog Property Compare-Operations](http://www.rsyslog.com/doc/v8-stable/configuration/filters.html#compare-operations) for a list of supported operators. These operators are validated with the `Rsyslog::PropertyOperator` data type.\n* `value` - the value that the property filter will match against.\n* `tasks` - A hash of actions to take in the event of a filter match.\n  * All sub-keys for the `tasks` hash maps to another rsyslog configuration object.\n\nPuppet Example:\n\n```puppet\nclass { 'rsyslog::config':\n  property_filters =\u003e {\n    'hostname_filter' =\u003e {\n      'property' =\u003e 'hostname',\n      'operator' =\u003e 'contains',\n      'value'    =\u003e 'some_hostname',\n      'tasks'    =\u003e [\n        {\n          'action' =\u003e {\n            'name'     =\u003e 'omfile_defaults',\n            'type'     =\u003e 'omfile',\n            'facility' =\u003e '*.*;auth,authpriv.none',\n            'config'   =\u003e {\n              'dynaFile'  =\u003e 'remoteSyslog',\n              'specifics' =\u003e '/var/log/test',\n            }\n          }\n        },\n        { 'stop' =\u003e true }\n      ]\n    },\n    'ip_filter' =\u003e {\n      'property' =\u003e 'fromhost-ip',\n      'operator' =\u003e 'startswith',\n      'value'    =\u003e '192',\n      'tasks'    =\u003e [\n        { 'stop' =\u003e true }\n      ]\n    }\n  }\n}\n```\n\nHiera Example:\n\n```yaml\nrsyslog::config::property_filters:\n  hostname_filter:\n    property: hostname\n    operator: contains\n    value: some_hostname\n    tasks:\n      - action:\n          name: omfile_defaults\n          type: omfile\n          facility: \"*.*;auth,authpriv.none\"\n          config:\n            dynaFile: \"remoteSyslog\"\n            specifics: \"/var/log/test\"\n      - stop: true\n  ip_filter:\n    property: fromhost-ip\n    operator: startswith\n    value: '192'\n    tasks:\n      - stop: true\n```\n\nwill produce\n\n```\n:hostname, contains, \"some_hostname\" {\n  *.*;auth,authpriv.none        action(type=\"omfile\" dynaFile=\"remoteSyslog\" specifics=\"/var/log/test\")\n  stop\n}\n\n:fromhost-ip, startswith, \"192\" {\n  stop\n}\n```\n\n###### Expression-based Filters\n\nExpression-based filters allow filtering on arbitrary complex expressions, which can include boolean, arithmetic and string operations.\n\nExpression-based filters are also what are used to match against lookup_table data.\n\nThe `rsyslog::config::expression_filters` parameter is a Hash of hashes where the hash-key is the logical name for the filter. This name is for Puppet resource naming purposes only and has no other function. The filter name has a few additional child keys as well:\n\n* `conditionals` - Hash describing the different conditional cases, which are hashes of hashes.\n    * `cases` - Hash of hashes. This has two reserved keys and four reserved names:\n      * `if`/`main` - This is the primary condition for your expression. `if` is provided for backwards compatibility. **_required_**\n      * `else`/`default` - This defines the optional \"default\" or \"fall through\" condition. `else` is provided for backwards compatibility.\n      * [string] case - All other cases are defined by your own descriptive name. These names are non-functional and purely for organizational purposes. They will render as an `else if` in the rsyslog configuration.\n    * `expression` - The string \"expression\" that will be used to match values. With all the potential options for logic, this was the easiest way to provide everyone with what they may need.\n    * `tasks` -  A hash of actions to take in the event of a filter match.\n      * All sub-keys for the `tasks` hash maps to another rsyslog configuration object.\n\n##### Puppet Examples\n\nOld Syntax (still works):\n```puppet\nclass { 'rsyslog::config':\n  expression_filters =\u003e {\n    'hostname_filter' =\u003e {\n      'conditionals' =\u003e {\n        'if' =\u003e {\n          'expression' =\u003e '$msg contains \"error\"',\n          'tasks'      =\u003e [\n            {\n              'action' =\u003e {\n                'name'   =\u003e 'omfile_error',\n                'type'   =\u003e 'omfile',\n                'config' =\u003e { 'specifics' =\u003e '/var/log/errlog' }\n              }\n            }\n          ]\n        }\n      }\n    }\n  }\n}\n```\n\nNew Syntax:\n```puppet\nclass { 'rsyslog::config':\n  expression_filters =\u003e {\n    'hostname_filter' =\u003e {\n      'conditionals' =\u003e {\n        'main' =\u003e {\n          'expression' =\u003e '$msg contains \"error\"',\n          'tasks'      =\u003e [\n            {\n              'action' =\u003e {\n                'name'   =\u003e 'omfile_error',\n                'type'   =\u003e 'omfile',\n                'config' =\u003e { 'specifics' =\u003e '/var/log/errlog' }\n              }\n            }\n          ]\n        }\n      }\n    }\n  }\n}\n```\n\n##### Hiera Examples\nOld syntax (still works):\n\n```yaml\nrsyslog::config::expression_filters:\n  hostname_filter:\n    conditionals:\n      # Uses the \"if\" keyword\n      if:\n        expression: '$msg contains \"error\"'\n        tasks:\n          - action:\n              name: omfile_error\n              type: omfile\n              config:\n                specifics: /var/log/errlog\n```\n\nNew syntax:\n\n```yaml\nrsyslog::config::expression_filters:\n  hostname_filter:\n    conditionals:\n      # Uses the \"main\" keyword\n      main:\n        expression: '$msg contains \"error\"'\n        tasks:\n          - action:\n              name: omfile_error\n              type: omfile\n              config:\n                specifics: /var/log/errlog\n```\n\nboth will produce:\n\n```\nif $msg contains \"error\" then {\n  action(type=\"omfile\" specifics=\"/var/log/errlog\")\n}\n```\n\nNOTE: Due to the amount of potential options available to the user, the `expression` key is a plain text string field and the expression logic must be written out. See next example for more details.\n\n##### Puppet Examples\nOld Syntax (still works):\n```puppet\nclass { 'rsyslog::config':\n  expression_filters =\u003e {\n    'complex_filter' =\u003e {\n      'conditionals' =\u003e {\n        'if' =\u003e {\n          'expression' =\u003e '$syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\")',\n          'tasks'      =\u003e [\n            { 'stop' =\u003e true }\n          ]\n        },\n        'else' =\u003e {\n          'tasks' =\u003e [\n            'action' =\u003e {\n              'name'   =\u003e 'error_log',\n              'type'   =\u003e 'omfile',\n              'config' =\u003e { 'specifics' =\u003e '/var/log/errlog' }\n            }\n          ]\n        }\n      }\n    }\n  }\n}\n```\n\n\nNew Syntax:\n```puppet\nclass { 'rsyslog::config':\n  expression_filters =\u003e {\n    'complex_filter' =\u003e {\n      'conditionals' =\u003e {\n        'main' =\u003e {\n          'expression' =\u003e '$syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\")',\n          'tasks'      =\u003e [\n            { 'stop' =\u003e true }\n          ]\n        },\n        'default' =\u003e {\n          'tasks' =\u003e [\n            'action' =\u003e {\n              'name'   =\u003e 'error_log',\n              'type'   =\u003e 'omfile',\n              'config' =\u003e { 'specifics' =\u003e '/var/log/errlog' }\n            }\n          ]\n        }\n      }\n    }\n  }\n}\n```\n\n##### Hiera Examples\nOld Syntax (still works):\n\n```yaml\nrsyslog::config::expression_filters:\n  complex_filter:\n    conditionals:\n      # Uses the \"if\" keyword\n      if:\n        expression: '$syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\")'\n        tasks:\n          - stop: true\n      # Uses the \"else\" keyword\n      else:\n        tasks:\n          - action:\n              name: error_log\n              type: omfile\n              config:\n                specifics: /var/log/errlog\n```\n\nNew Syntax:\n\n```yaml\nrsyslog::config::expression_filters:\n  complex_filter:\n    conditionals:\n      # Uses the \"main\" keyword\n      main:\n        expression: '$syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\")'\n        tasks:\n          - stop: true\n      # Uses the \"default\" keyword\n      default:\n        tasks:\n          - action:\n              name: error_log\n              type: omfile\n              config:\n                specifics: /var/log/errlog\n```\n\nboth will produce:\n\n```\nif $syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\") then {\n  stop\n}\nelse {\n  action(type=\"omfile\" specifics=\"/var/log/errlog\")\n}\n```\n\n\nExample using more than two conditions:\n\n#### Puppet Examples\n```puppet\nclass { 'rsyslog::config':\n  expression_filters =\u003e {\n    'conditionals' =\u003e {\n      'main' =\u003e {\n        'expression' =\u003e '$syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\")',\n        'tasks'      =\u003e [{ 'stop' =\u003e true }]\n      },\n      'errlog' =\u003e {\n        'expression' =\u003e '$msg contains \"error\"',\n        'tasks'      =\u003e [\n          {\n            'action' =\u003e {\n              'name'   =\u003e 'omfile_error',\n              'type'   =\u003e 'omfile',\n              'config' =\u003e { 'specifics' =\u003e '/var/log/errlog' }\n            }\n          }\n        ]\n      },\n      'default' =\u003e {\n        'tasks' =\u003e [\n          {\n            'action' =\u003e {\n              'name'   =\u003e 'system_log',\n              'type'   =\u003e 'omfile',\n              'config' =\u003e { 'specifics' =\u003e '/var/log/system' }\n            }\n          }\n        ]\n      }\n    }\n  }\n}\n```\n\n#### Hiera Examples\n\n```yaml\nrsyslog::config::expression_filters:\n  complex_filter:\n    conditionals:\n      # Uses the \"main\" keyword\n      main:\n        expression: '$syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\")'\n        tasks:\n          - stop: true\n      # Uses a descriptive keyname\n      errlog:\n        expression: '$msg contains \"error\"'\n        tasks:\n          - action:\n              name: omfile_error\n              type: omfile\n              config:\n                - specifics: /var/log/errlog\n      # Uses the \"default\" keyword\n      default:\n        tasks:\n          - action:\n              name: system_log\n              type: omfile\n              config:\n                specifics: /var/log/system\n```\n\nwill produce:\n\n```\nif $syslogfacility-text == \"local0\" and $msg startswith \"DEVNAME\" and ($msg contains \"error1\" or $msg contains \"error0\") then {\n  stop\n} else if $msg == \"error\" then {\n  action(type=\"omfile\" specifics=\"/var/log/errlog\")\n} else {\n  action(type=\"omfile\" specifics=\"/var/log/system\")\n}\n```\n\n##### `rsyslog::config::legacy_config`\n\nLegacy config support is provided to facilitate backwards compatibility with `sysklogd` format as this module mainly supports `rainerscript` format.\n\nA hash of hashes, each hash name is used as the comment/reference for the setting and the hash will have the following values:\n\n* `key`: the key/logger rule setting\n* `value`: the value/target of the setting\n* `type`: the type of format to use (legacy or sysklogd), if omitted sysklogd is used. If legacy type is used `key` can be skipped and one long string can be provided as value.\n\n##### Puppet Examples\n```puppet\nclass { 'rsyslog::config':\n  legacy_config =\u003e {\n    'auth_priv_rule' =\u003e {\n      'key'   =\u003e 'auth,authpriv.*',\n      'value' =\u003e '/var/log/auth.log',\n    },\n    'auth_none_rule' =\u003e {\n      'key'   =\u003e '*.*;auth,authpriv.none',\n      'value' =\u003e '/var/log/syslog',\n    },\n    'syslog_all_rule' =\u003e {\n      'key'   =\u003e 'syslog.*',\n      'value' =\u003e '/var/log/rsyslog.log',\n    },\n    'mail_error_rule' =\u003e {\n      'key'   =\u003e 'mail.err',\n      'value' =\u003e '/var/log/mail.err',\n    },\n    'news_critical_rule' =\u003e {\n      'key'   =\u003e 'news.crit',\n      'value' =\u003e '/var/log/news/news.crit',\n    }\n  }\n}\n```\n\n##### Hiera Examples\n\n```yaml\nrsyslog::config::legacy_config:\n  auth_priv_rule:\n    key: \"auth,authpriv.*\"\n    value: \"/var/log/auth.log\"\n  auth_none_rule:\n    key: \"*.*;auth,authpriv.none\"\n    value: \"/var/log/syslog\"\n  syslog_all_rule:\n    key: \"syslog.*\"\n    value: \"/var/log/rsyslog.log\"\n  mail_error_rule:\n    key: \"mail.err\"\n    value: \"/var/log/mail.err\"\n  news_critical_rule:\n    key: \"news.crit\"\n    value: \"/var/log/news/news.crit\"\n```\n\nwill produce\n\n```\n# auth_priv_rule\nauth,authpriv.*    /var/log/auth.log\n\n# auth_none_rule\n*.*;auth,authpriv.none    /var/log/syslog\n\n# syslog_all_rule\nsyslog.*    /var/log/rsyslog.log\n\n# mail_error_rule\nmail.err    /var/log/mail.err\n\n# news_critical_rule\nnews.crit    /var/log/news/news.crit\n\n```\n\nlegacy type values can be passed as one long string skipping the key parameter like below and you can also override the priority in the hash to rearrange the contents\neg:\n\n```yaml\n  emergency_rule:\n    key: \"*.emerg\"\n    value: \":omusrmsg:*\"\n  testing_legacy_remotelog:\n    value: \"*.* @@logmonster.cloudfront.net:1514\"\n    type: \"legacy\"\n    priority: 12\n  testing_legacy_rule:\n    value: \"*.* \u003edbhost,dbname,dbuser,dbpassword;dbtemplate\"\n    type: \"legacy\"\n\n```\n\nwill produce\n\n```\n# emergency_rule\n*.emerg    :omusrmsg:*\n\n# testing_legacy_rule\n*.* \u003edbhost,dbname,dbuser,dbpassword;dbtemplate\n\n# testing_legacy_remotelog\n*.* @@logmonster.cloudfront.net:1514\n\n```\n\n### Positioning\n\nAll rsyslog object types are positioned according to the default variables (see [Ordering](#ordering)).  The position can be overridden for any object by adding the optional `priority` parameter.\n\neg:\n\n```yaml\nrsyslog::config::actions:\n  elasticsearch:\n    type: omelasticsearch\n    config:\n      queue.type: \"linkedlist\"\n      queue.spoolDirectory: \"/var/log/rsyslog/queue\"\n    priority: 35\n```\n\n### Formatting\n\nThis module attempts to abstract rainerscript objects into data structures that can be handled easily within hiera, however there are clearly times when you need to add some more code structure around an object, such as conditionals.  For simple code additions, the `template`, `action`, `input` and `global_config` object types support the optional parameter of `format` which takes Puppet EPP formatted template as a value, using the variable `$content` to signify the object itself.   For example, to wrap an action in a simple conditional you could format it as\n\neg:\n\n```yaml\nrsyslog::config::actions:\n  elasticsearch:\n    type: omelasticsearch\n    config:\n      queue.type: \"linkedlist\"\n      queue.spoolDirectory: \"/var/log/rsyslog/queue\"\n    format: |\n      if [ $fromhost == \"foo.localdomain\"] then {\n      \u003c%= $content %\u003e\n      }\n```\n\nFor more complicated code structures that don't lend themselves well to a structured format, like multiple nested conditionals there is also a special configuration object type called custom_config.    `custom_config` takes two arguments, `priority` to determine where in the file it should be configured, and `content` a text string to insert. By default the priority is set by the `custom_config_priority` parameter (see [Ordering](#ordering))\n\n```yaml\nrsyslog::config::custom_config:\n  localhost_action:\n    priority: 45\n    content: |\n      if $fromhost == [\"foo.localdomain\",\"localhost\"] then {\n        action(type=\"omfile\" file=\"/var/log/syslog\")\n      } else {\n       action(type=\"omelasticsearch\"\n         queue.type=\"linkedlist\"\n         queue.spoolDirectory=\"/var/log/rsyslog/queue\"\n       )\n    }\n\n  stop:\n    content: |\n      if [ $fromhost == \"foo\" ] then stop\n\n```\n\n## Known Issues\n\n* Designed specifically for Rsyslog 8+ and the Rainerscript configuration format. Legacy configuration/Rsyslog \u003c 8 support requires the use of the `custom_config` parameter.\n* The upstream repository for EL8 is currently broken and will not work.\n\n## License\n\n* This module is licensed under Apache 2.0, see LICENSE for more details\n\n## Maintainer\n\n* This module is maintained by Vox Pupuli.  It was originally written by Craig Dunn (craig@craigdunn.org) @crayfishx.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-rsyslog","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvoxpupuli%2Fpuppet-rsyslog","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-rsyslog/lists"}