rsyslog template variables – where to find them

Did you search for “rsyslog template variables”? And landed here? Many folks do, so let me explain where you actually find them. TLDR: find them in the property doc.

Screenshot of rsyslog configuration
A screenshot of a rsyslog configuration snippet involving a somewhat more complex template. (Rainer Gerhards, 2020)

The rsyslog official documentation does not get many hits on that search term. The technical reason is that, in rsyslog speak, templates use “properties“, not “variables“. This has historic background. Initially, there were only messages, which contained properties. And these were read-only … and far from variable. Thus the name.

Later we introduced properties which are modifiable – and called them “variable properties” in a try to keep consistent. People, of course, soon began to call them “rsyslog variables“. I admit this was more up to the point.

Bottom line: if you search for rsyslog template variables, follow this link ;-)

I will also see that I make some updates to the official doc. Some interlinking will possibly also help. Just so that you know…