Sstrhsrtj

being on Ubuntu 16.04.5 LTS with rsyslogd.

We have the following situation:

(1) An appliance forwards syslog to the Ubuntu host.
(2) Ubuntu Host stores those forwarded messages in a separate logfile
(3) Ubuntu Host also forwards this to a 3rd machine

Details how configuration currently looks like

(1)
In /etc/rsyslog.conf, follwing has been enabled:

# provides UDP syslog reception

module(load="imudp")

input(type="imudp" port="514")



# provides TCP syslog reception

module(load="imtcp")

input(type="imtcp" port="514")

(2)
Has been achieved by creating 30-remotehosts.conf in /etc/rsyslog.d with following content:

:fromhost-ip, isequal, "<sending_IP>" /var/log/remotesyslog/<name>.log

& ~

(3) has been achieved by way of creating 10-send_to_other_hosts.conf in /etc/rsyslog.d with following content:

:fromhost-ip, isequal, "<sending_IP>"   @<destination_IP>:514

So far so good, works as expected.

However, what we would need now is to alter the logline before sending to the destination.

One example log line currently is

Dec  7 11:10:07 srvde450.rce-group.local [S=582442040] [SID=9642c9:20:3850677]  1 RTP packets lost: CID=217 [Code:0x600b] [CID:217] [Time:07-12@10:10:13]

We would neet it to be changed to the following before sending to the destination:

[S=582442040] [SID=9642c9:20:3850677]  1 RTP packets lost: CID=217 [Code:0x600b] [CID:217] [Time:07-12@10:10:13]

So remove timestamp and source.

How could that be achieved?

You should be able to do this by specifying a template for the data which would just have the msg field. Note, however, that the remote server may not parse the resulting non-standard line, so it may not be able to handle it using a default setup.

Create a template with, for example,

$template myedit,"%msg%n"

and use it in your filter line:

:fromhost-ip, isequal, "<sending_IP>"   @<destination_IP>:514;myedit