Cannot decode syslog message about lua_sandbox_extensions

[trink]

You have to specify the proper template in your cfg; in this case ForwardFormat see https://rsyslog-5-8-6-doc.neocities.org/rsyslog_conf_templates.html.

template= "<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"

The default is TraditionalForwardFormat

[cvuillemez]

Template is still defined in /usr/share/luasandbox/io_modules/decoders/syslog.lua at line #38 (for Ubuntu, this file is provided by deb package lua-sandbox-extensions 0~git20161128-1) :
local template = read_config("template") or "<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"

So it's not the root cause.
Thanks.

[cvuillemez]

@trink can you re-open this issue ?

[trink]

?? I am unclear on what the perceived problem is (the above reference is to a PR that was not accepted). The current packages and cfg work as expected as per https://mozilla-services.github.io/lua_sandbox_extensions/syslog/io_modules/decoders/syslog.html

[cvuillemez]

OK I pointed the mistake. My test message doesn't match the default template, and I test different templates format, but I put them in wrong place in configuration file:

filename = "tcp.lua"
address = "*"
decoder_module = "decoders.syslog"
send_decode_failures = true
decoders_syslog = { 
  template = "<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%",
}

Template is well apllied with this config:

filename = "tcp.lua"
address = "*"
decoder_module = "decoders.syslog"
send_decode_failures = true
template = "<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"

So payload parsing is ok. Sorry for the mistake.

Note: the reference #38 is not a reference, i juste wanted to write "line 38" !