I've got the following rsyslog conf and the below log message I'm receiving. I would like to add an uuid to each log message.
I'm currently generating a uuid as follows. However, the uuid is not being formatted as rfc4122 which I would like to do. Am I doing something wrong, or could this be achieved in a better way?
Currently: F2GCCB4C390142A4B9DBVBD8B9FD0ED2
. What I would like: f2gccb4c-3901-42a4-b9db-vbd8b9fd0ed2
/path/to/log/file.log
11955 - [Mon Apr 6 20:40:03 2023] [Info ] This message can contain anything [d54d13fa-4657-4891-f99d08674ee]
/etc/rsyslog.d/mylog.conf
template(name="jsonFormat" type="list") {
property(outname="id" name="uuid" format="jsonf")
}
The only way to lowercase a string is within a template using a property replacer. There are 3 ways to use this. Probably the most readable is to use some RainerScript to build up the rfc4122 uuid format first:
set $.uuid = substring($uuid,0,8) & "-" & substring($uuid,8,4);
template(name="myformat" type="list") {
property(name="$.uuid" outname="uuid" caseconversion="lower" format="jsonf")
}
This sets variable $.uuid
to the concatenation (&
) of the appropriate
substrings (index from 0, length) of the uuid property. I have just shown
the first 2 parts; the rest needs to be done similarly.
The template then just applies the lowercasing.
Alternatively, it can all be done in the template, but it is very verbose:
template(name="myformat" type="list") {
constant(value=" \"uuid\":\"")
property(name="uuid" position.from="1" position.to="8" caseconversion="lower")
constant(value="-")
property(name="uuid" position.from="9" position.to="12" caseconversion="lower")
...
}
Note that positions start from 1, and the to
is inclusive.
Finally, you can use a terser string template and "execute" it, to capture the resulting string in a variable:
template(name="myuuid" type="string" string="%uuid:1:8:lowercase%-%uuid:9:12:lowercase%")
set $.uuid = exec_template("myuuid");
Here the substring is start and end inclusive, starting from 1.