Parsing Rsyslog hostname

[potistiri]

I'd like to thank you 🙏🏽 for this project! It's awesome!

I have selfhost logward and setup with proxmox rsyslog, I am trying to show somehow the source ip of syslog events but so far the only information is plain data event by categorizing them of service. In case i have more than 1 rsyslog client , is there a way to also show the source ip/hostname of that rsyslog ?

Thank you
BR

[Polliog]

Thanks so much for the kind words and for trying out LogWard! 🙏

There are a couple of approaches:

1. Use the service field for hostname identification
   When configuring your rsyslog to forward to LogWard, set the service field to the hostname of each client. This way you can filter logs by source machine directly in the UI.

2. Use the metadata field for additional context
   LogWard's log schema includes a metadata JSON field where you can store arbitrary data. You could include:

  {
    "source_ip": "192.168.1.100",
    "hostname": "proxmox-node-1",
    "facility": "kern"
  }

3. Rsyslog template example
   In your rsyslog config, you'd create a template that forwards to LogWard's API with the hostname included:

  template(name="LogWardFormat" type="list") {
    constant(value="{\"service\":\"")
    property(name="hostname")
    constant(value="\",\"level\":\"info\",\"message\":\"")
    property(name="msg" format="jsonf")
    constant(value="\",\"metadata\":{\"source_ip\":\"")
    property(name="fromhost-ip")
    constant(value="\"}}")
  }

I'm going to consider adding a first-class source or host field to the log schema if this is a common use case.

Let me know if you need help with the specific rsyslog configuration