loggingrsyslog

rsyslog generate uuid as rfc4122

I've got the following rsyslog conf and the below log message I'm receiving. I would like to add an uuid to each log message.

I'm currently generating a uuid as follows. However, the uuid is not being formatted as rfc4122 which I would like to do. Am I doing something wrong, or could this be achieved in a better way?

Currently: F2GCCB4C390142A4B9DBVBD8B9FD0ED2. What I would like: f2gccb4c-3901-42a4-b9db-vbd8b9fd0ed2

/path/to/log/file.log

 11955 - [Mon Apr  6 20:40:03 2023] [Info   ] This message can contain anything [d54d13fa-4657-4891-f99d08674ee]

/etc/rsyslog.d/mylog.conf

template(name="jsonFormat" type="list") {
    property(outname="id" name="uuid" format="jsonf")
}
Solution

  • The only way to lowercase a string is within a template using a property replacer. There are 3 ways to use this. Probably the most readable is to use some RainerScript to build up the rfc4122 uuid format first:

    set $.uuid = substring($uuid,0,8) & "-" & substring($uuid,8,4);
template(name="myformat" type="list") {
 property(name="$.uuid" outname="uuid" caseconversion="lower" format="jsonf")
}

    This sets variable $.uuid to the concatenation (&) of the appropriate substrings (index from 0, length) of the uuid property. I have just shown the first 2 parts; the rest needs to be done similarly. The template then just applies the lowercasing.

    Alternatively, it can all be done in the template, but it is very verbose:

    template(name="myformat" type="list") {
 constant(value=" \"uuid\":\"")
 property(name="uuid" position.from="1" position.to="8" caseconversion="lower")
 constant(value="-")
 property(name="uuid" position.from="9" position.to="12" caseconversion="lower")
 ...
}

    Note that positions start from 1, and the to is inclusive.

    Finally, you can use a terser string template and "execute" it, to capture the resulting string in a variable:

    template(name="myuuid" type="string" string="%uuid:1:8:lowercase%-%uuid:9:12:lowercase%")
set $.uuid = exec_template("myuuid");

    Here the substring is start and end inclusive, starting from 1.