Posted on by Rainer Gerhards

YAML for rsyslog — a new option, not a revolution

rsyslog’s configuration language has grown into a very capable scripting environment — RainerScript — that can express almost anything a log pipeline might need. For complex systems, that won’t change.
But many modern environments — especially containerized and cloud-native ones — expect configuration in YAML. So the idea is simple: rsyslog should understand that world directly.

Symbol image for “Engineering Rational” type of postings. (Image: Rainer Gerhards via AI)

Why YAML now?

YAML is today’s common ground. Orchestration, automation, CI/CD — everything around rsyslog already speaks it. By adding YAML support, we make rsyslog easier to integrate into those workflows without changing what’s already stable and proven.

This isn’t about replacing RainerScript. It’s about matching the right tool to the right level of complexity: YAML for straightforward setups. RainerScript for advanced ones. Both can coexist.

The library question…

We looked at several YAML libraries. In the end, libyaml won — not because it’s glamorous, but because it’s small, proven, and available everywhere that matters.
If it’s not present, rsyslog will still build and run; YAML just stays dormant.
Minimalists can even disable it entirely at build time. Optional really means optional.

The first step: rate-limiting in YAML

The first place where YAML will appear is the new ratelimit() configuration object. Right now, I am getting my hands dirty on crafting that code.
It turns the classic parameters into a clean, self-contained definition.

RainerScript:

ratelimit(name="inputLimit" interval="5" burst="200")

YAML equivalent:

ratelimit:
  name: inputLimit
  interval: 5
  burst: 200

Functionally identical, but structured in a way that feels natural in modern automation contexts. The actual yaml will be a bit different, but you get the idea.

Mixing YAML and RainerScript

YAML is great at describing what you want — not how or when. As soon as you start adding logic, indentation anxiety sets in. That’s why rsyslog’s YAML files will allow embedded RainerScript fragments wherever logic belongs:

actions:
  - if: '$msg contains "error" then call reportError()'
  - if: '$syslogfacility == 4 then stop'

It’s a hybrid model: declarative in YAML, expressive in RainerScript. Other systems do the same — Kubernetes templates, Logstash configs — so this will feel familiar, not experimental.

Not another confusing format

There will be clear guidance on when YAML makes sense:

  • Simple, self-contained setups
  • Cloud-native environments
  • Cases where configuration is generated by automation tools

We’ll also provide sample configs and “pre-cooked” meta-templates, similar to the environment variable presets used in our official containers. Maybe not in the first shots, but definitely a plan. And easy to carry out, as we can build on the container work.
The goal is that YAML doesn’t feel like yet another syntax to learn — it should feel cozy and comfortable, something you already know from the rest of your stack.

And of course, the hard guys with tough problems can still write powerful, as-complex-as-they-like RainerScript configurations. That’s not going away — it’s just no longer the only way in.

Legacy configuration — optional, not mandatory

Legacy syntax will remain supported but can be disabled or warned about through configuration. Default will likely be “enabled, but warn,” allowing smooth modernization without surprise breakage.

YAML policies for JSON transformation

As another step and kind of pre-project, rsyslog will gain YAML-based policies for mmjsontransform.
They describe how to rename, validate, normalize, or redact JSON data — reloaded on HUP, versionable, and human-readable.
This makes everyday data shaping tasks easy to automate and audit.

What’s next

  • Ship ratelimit() as the first YAML-aware object
  • Add reloadable YAML policies for JSON processing
  • Expand embedded RainerScript support in YAML
  • Provide starter configs and meta-templates for container and cloud use
  • Add switches to disable legacy configuration

So yes — rsyslog will most probably soon speak YAML.
For most users, it’ll just feel like configuring any other modern tool.
And for the rest of us who enjoy bending the laws of log physics — RainerScript will still be there, waiting, as flexible and complex as ever.