3.7. Template objects

The syslog-ng application allows you to define message templates, and reference them from every object that can use a template. Templates can be used to create standard message formats or filenames. Templates can reference one or more macros (e.g., date, the hostname, etc.). See Section 9.5, “Macros” for a list of available macros.

Template objects have a single option called template_escape, which is turned on by default (template_escape(yes)). This causes syslog-ng to escape the ' and " characters from the messages. This behavior might cause problems when the messages are passed to a an application that cannot handle escaped characters properly. In such case, disable the escape feature (template_escape(no)).

[Note] Note

Earlier versions of syslog-ng used templates and scripts to send log messages into SQL databases. Starting from version 2.1, syslog-ng natively supports direct database access using the sql() destination. See Section 9.2.5, “sql()” for details.

[Example] Example 3.8. Using templates

The following template (t_demo_filetemplate) adds the date of the message and the name of the host sending the message to the beginning of the message text. The template is then used in a file destination: messages sent to this destination (d_file) will use the message format defined in the template.

template t_demo_filetemplate { 
             template("$ISODATE $HOST $MSG\n"); template_escape(no); };          
destination d_file { 
             file("/var/log/messages" template(t_demo_filetemplate)); };
            

Templates can also be used inline, if they are used only at a single location. The following destination is equivalent with the previous example:

destination d_file { 
             file("/var/log/messages" 
                template("$ISODATE $HOST $MSG\n"; template_escape(no))); };
            

© 2007 BalaBit IT Security
Please send your comments or documentation bugs to: documentation@balabit.com