soc-ops/global/overlay/etc/puppet/modules/soc/templates/rsyslog/rsyslog-remote.conf.erb

# Remote syslog configuration managed by Puppet (sunet::rsyslog)
# Remote enabled by syslog_enable_remote: <%= @do_remote %>

<% if @do_remote %>
<% @syslog_servers.each do |server| -%>
action(
  type="omfwd"
  Target="<%= server.split(':')[0] %>"
  Port="<%= server.split(':')[1] %>"
)
<% end -%>

<% if @relp_syslog_servers != [] -%>
module(load="omrelp")

<% @relp_syslog_servers.each do |server| -%>
action(
  type="omrelp"
  target="<%= server.split(':')[0] %>"
  port="<%= server.split(':')[1] %>"
)
<% end -%>
<% end -%>

<% if @gelf_graylog_servers != [] -%>
template(name="gelf" type="list") {
    constant(value="{\"version\":\"1.1\",")
    constant(value="\"host\":\"")
    property(name="hostname")
    constant(value="\",\"short_message\":\"")
    property(name="msg" format="json")
    constant(value="\",\"timestamp\":\"")
    property(name="timegenerated" dateformat="unixtimestamp")
    constant(value="\",\"level\":\"")
    property(name="syslogseverity")
    constant(value="\"}")
}

<% @gelf_graylog_servers.each do |server| -%>
action(
  type="omfwd"
  target="<%= server.split(':')[0] %>"
  port="<%= server.split(':')[1] %>"
  protocol="udp"
  template="gelf"
)
<% end -%>
<% end -%>

<% end -%>