【rsyslog】使用rsyslog采集设备日志输出到logstash

module(load="imudp" threads="4"
       timeRequery="8" batchSize="128")

input(type="imudp" port="514"
      ruleset="writeRemoteData")

template(name="outfmt" type="string" 
     string="{\"message\":\"%msg:::json%\",\"source\":\"%fromhost%\",\"facility\":\"%syslogfacility-text%\",
\"priority\":\"%syslogpriority-text%\",\"timereported\":\"%timereported:::date-rfc3339%\",\"timegenerated\":\"%timegenerated:::date-rfc3339%\"}")

ruleset(name="writeRemoteData"
	queue.filename="mainQ"
	queue.spoolDirectory="/app/wutongshu/rsyslog"
    queue.type="LinkedList"
	queue.maxfilesize="1024M"
	queue.saveOnShutdown="on"
    queue.size="2500000"
    queue.dequeueBatchSize="4096"
    queue.workerThreads="8"
#	queue.discardSeverity ="4"
    queue.workerThreadMinimumMessages="120000"
       ) {
    action(type="omfwd" template="outfmt" target="192.168.113.99" port="5144" protocol="tcp")
}

参考：高性能接收日志样例

参考：队列基础知识

参考：队列参数

参考：队列权威指南