module(load="omelasticsearch")
template(name="plain-syslog" type="list" option.json="on") {
    constant(value="{")
    constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"host\":\"")        property(name="hostname")
    constant(value="\",\"severity-num\":")  property(name="syslogseverity")
    constant(value=",\"facility-num\":")    property(name="syslogfacility")
    constant(value=",\"severity\":\"")      property(name="syslogseverity-text")
    constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")
    constant(value="\",\"syslogtag\":\"")   property(name="syslogtag")
    constant(value="\",\"programname\":\"") property(name="programname")
    constant(value="\",\"procid\":\"")      property(name="procid")
    constant(value="\",\"message\":\"")     property(name="msg")
    constant(value="\"}")
}
template(name="rsyslog-index" type="string" string="rsyslog-%$YEAR%.%$MONTH%.%$DAY%")
action(type="omelasticsearch" server="<elastic_node>" serverport="9200" template="plain-syslog" searchIndex="rsyslog-index" dynSearchIndex="on" bulkmode="on" errorfile="/var/log/omelasticsearch.log" uid="<elastic_user>" pwd="********" tls.cacert="/etc/rsyslog.d/certs/ca.crt" tls.mycert="/etc/rsyslog.d/certs/<node>.crt" tls.myprivkey="/etc/rsyslog.d/certs/<node>.key" usehttps="on")
