Document how to write logs in RFC5424 format

[lpar]

What section you wish to enhance

Maybe "The Configuration File", maybe "Destinations > File", maybe "Template and Rewrite"?

Description of the problem

The first thing I wanted to do after installing syslog-ng was update the log format to be RFC5424 instead of legacy format. I wasn't able to find out how to do this by searching the documentation site.

Proposed solution

Provide a simple example of how to use standard RFC5424 for local logs, including structured data support.

[HofiOne]

Hi,

Could you please clarify what you would like to achieve exactly?
Do you want to interpret, process, and forward RFC5424-formatted log messages, or produce a final log file containing only RFC5424-formatted entries? Anything else?

[lpar]

I would like my log files to contain RFC5424-formatted entries, rather than legacy format.

[HofiOne]

Sorry, it is still not clear. Could you please specify which logs you would like to see in that format? Refer to my previous question and provide more details about your use case.

[lpar]

I would like all log files that pass through syslog-ng to be written in RFC5424 format, particularly all log files in /var/log.

I want every syslog message formatted to RFC5424 everywhere, without exception.

[bazsi]

Just set flags(syslog-protocol) on the file() destination, it should do the trick.