rsyslog.conf

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

## Template to handle JSON formatting
template(name="json" type="list") {
  constant(value="{")
  property(outname="timestamp" name="timereported" format="jsonf" dateFormat="rfc3339")
  constant(value=",")
  property(outname="loghost" name="$myhostname" format="jsonf")
  constant(value=",")
  property(outname="tag" name="syslogtag" format="jsonf")
  constant(value=",")
  property(outname="severity" name="syslogseverity-text" format="jsonf")
  constant(value=",")
  property(outname="message" name="msg" format="jsonf")
  constant(value="}")
  constant(value="\n")
}

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")

# Include all config files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf")

### LOGS ###

# Enable standard syslog socket to log audit log changes
module(load="imuxsock")

module(load="imfile")

# Supervisord
input(type="imfile"
      File="/var/log/supervisor/supervisord.log"
      Tag="supervisord"
      Severity="info")

# Apache access file
input(type="imfile"
      File="/var/log/httpd/access_log"
      Tag="apache-access"
      Severity="info")

# Apache error file
input(type="imfile"
      File="/var/log/httpd/error_log"
      Tag="apache-error"
      Severity="error")

# PHP-FPM error file
input(type="imfile"
      File="/var/log/php-fpm/error.log"
      Tag="php-fpm-error"
      Severity="error")

# PHP-FPM www error file
input(type="imfile"
      File="/var/log/php-fpm/www-error.log"
      Tag="php-fpm-www-error"
      Severity="error")

# PHP-FPM access file
input(type="imfile"
      File="/var/log/php-fpm/www.access.log"
      Tag="php-fpm-access"
      Severity="info")

# MISP debug logs
input(type="imfile"
      File="/var/www/MISP/app/tmp/logs/debug.log"
      Tag="misp-debug"
      Severity="info")

# MISP logs from executing external scripts
input(type="imfile"
      File="/var/www/MISP/app/tmp/logs/exec-errors.log"
      Tag="misp-exec-error"
      Severity="error")

# MISP stderr logs from ZMQ server
input(type="imfile"
      File="/var/www/MISP/app/tmp/logs/mispzmq.error.log"
      Tag="mispzmq-error"
      Severity="error")

# MISP stdout logs from ZMQ server
input(type="imfile"
      File="/var/www/MISP/app/tmp/logs/mispzmq.log"
      Tag="mispzmq"
      Severity="info")