#This file will configure rsyslog to send your data to  Coralogix.
#*****************************************************************#
#                        TEMPLATE SECTION                         #
#*****************************************************************#
#Coralogix log format
$template CoralogixSyslogFormat,"{\"fields\": {\"private_key\":\"530e925d-be9e-****-****-75884f54efbe\",\"company_id\":\"****\",\"app_name\":\"prod\",\"subsystem_name\":\"%programname%\"},\"message\": {\"message\":\"%msg:::json%\",\"program_name\":\"%programname%\",\"pri_text\":\"%pri-text%\",\"hostname\":\"%HOSTNAME%\",\"tag\":\"%syslogtag%\"}}\n"
#*****************************************************************#
#                   RSYSLOG CONFIGURATION SECTION                 #
#*****************************************************************#
#Default location for work (spool) files
$WorkDirectory /rsyslog/work
#Use asynchronous processing
$ActionQueueType LinkedList
#Set file name, also enables disk mode
$ActionQueueFileName srvrfwd
#Maximum allowed disk space to use in case of disconnection
$ActionQueueMaxDiskSpace 100m
#Infinite retries on insert failure
$ActionResumeRetryCount -1
#Save in-memory data if rsyslog shuts down
$ActionQueueSaveOnShutdown on

#*****************************************************************#
#                        FILTER SECTION                           #
#*****************************************************************#
#Filter messages and send only the relevant one
#For more information and other filter options please refer to:
#http://www.rsyslog.com/doc/v8-stable/configuration/filters.html
#This will filter messages and send only the one with program name equal to: myApp
#:programname, isequal, "myapp"
#This will filter messages and send only the one with facility equal to: user
#:syslogfacility-text, isequal, "user"
#*****************************************************************#
#                      DESTINATION SECTION                        #
#*****************************************************************#
#Send with UDP
*.* @syslogserver.coralogix.com:5140;CoralogixSyslogFormat

#Send with TCP
#*.* @@syslogserver.coralogix.com:5140;CoralogixSyslogFormat

#Print messages locally. Great for debugging
*.* /var/log/messages-coralogix-format;CoralogixSyslogFormat