# Template Definitions
# Version 1.46

# DEFUNCT "Per Host" CEF message file
template(name="cef.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/cef"
        )

#  CEF message format - not used but may be needed in the future
template(name="cef.message"
         type="string"
         string="%rawmsg%\n"
        )

#  "Per Host" Kiwi message file
template(name="kiwi.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/kiwi"
        )

#  Per Host Kiwi  message format - DEPRECATED as we will use builtin:omfile
template(name="kiwi.message"
         type="string"
         string="%rawmsg%\n"
        )

#  "Per Host" unfiltered message file
template(name="unfiltered.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/unfiltered"
        )

#  Per Host unfiltered  message format  - DEPRECATED as we will use builtin:omfile
template(name="unfiltered.message"
         type="string"
         string="%msg%\n"
        )

# "Per Host" QRADAR message file
template(name="qradar.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/qradar"
        )

#  Per Host QRADAR  message format  - DEPRECATED as we will use builtin:omfile
#  Notice that %rawmsg% is used instead of %msg%
#  %rawmsg% is unaltered message. %msg% is after some processing is done.
template(name="qradar.message"
         type="string"
         string="%rawmsg%\n"
        )


# "Per Host" ZPA message file
template(name="zpa.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/zpa"
        )

# ZPA message format - DEPRECATED as we will use builtin:omfile
template(name="zpa.message"
         type="string"
         string="%msg%\n"
        )

# "Per Host" SYSLOG message file
template(name="syslog.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/messages"
        )

#  "Per Host" OMSAGENT message file for CEF formst
template(name="omsagent-cef.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/omsagent-cef"
        )

#  "Per Host" OMSAGENT message file for SYSLOG format
template(name="omsagent-syslog.file"
         type="string"
         string="/var/log/rsyslog/%fromhost-ip%/omsagent-syslog"
        )

#  Per Host OMSAGENT message format  - DEPRECATED as we will use builtin:omfile
template(name="omsagent.message"
         type="string"
         string="%rawmsg%\n"
        )

# Custom template using OMUDPSPOOF module for forwarding event with the source IP address
# in the header since rsyslog uses FQDN if available by default
template(name="forward.message"
        type="string"
        string="%fromhost-ip%"
)

# Custom template which takes the "RSYSLOG_TraditionalForwardFormat" default
# template but substitutes %HOSTNAME% with %fromhost-ip%
# See: https://www.rsyslog.com/doc/v8-stable/configuration/templates.html
template(name="TraditionalFwdWithIP"
        type="string"
        string="%TIMESTAMP% %fromhost-ip% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
)
