I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this:

Jan  1 00:00:47 kernel: br0: port 1(eth0) entered forwarding state

What's the best way to do this for all messages from this router (


1 Answer 1


The easiest way to handle this is to write a template that is a copy of the template you are already using, and change the timestamp property to the timegenerated property. Eg, assuming you are writing to a file and using the default RSYSLOG_TraditionalFileFormat template, then you can create myFileFormat, test for the ip address and put in your matching rules. In legacy format the rule uses the log filename followed by ; and the name of the template:

template(name="myFileFormat" type="string" string="%timegenerated% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp% %msg:::drop-last-lf%\n") 
if $fromhost-ip == "" then {
   *.* /my/logfile;myFileFormat
  • This is perfect thanks. It's also clicked for me now how templates work.
    – goji
    Commented May 27, 2020 at 9:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .