<commit_before>Templates
=========

Templates are a key feature of rsyslog. They allow to specify any format
a user might want. They are also used for dynamic file name generation.
Every output in rsyslog uses templates - this holds true for files, user
messages and so on. The database writer expects its template to be a
proper SQL statement - so this is highly customizable too. You might ask
how does all of this work when no templates at all are specified. Good
question ;). The answer is simple, though. Templates compatible with the
stock syslogd formats are hardcoded into rsyslogd. So if no template is
specified, we use one of those hardcoded templates. Search for
"template\_" in syslogd.c and you will find the hardcoded ones.

Templates are specified by template() statements. They can also be
specified via $template legacy statements.

**Note: key elements of templates are rsyslog properties.** See the
:doc:`rsyslog properties reference <properties>` for a list of which
are available.

The template() statement<commit_msg>Update templates.rst<commit_after>Templates
=========

Templates are a key feature of rsyslog. They allow to specify any format
a user might want. They are also used for dynamic file name generation.
Every output in rsyslog uses templates - this holds true for files, user
messages and so on. The database writer expects its template to be a
proper SQL statement - so this is highly customizable too. You might ask
how does all of this work when no templates at all are specified. Good
question ;). The answer is simple, though. Templates are compatible with the
stock syslogd formats which are hardcoded into rsyslogd. So if no template is
specified, we use one of those hardcoded templates. Search for
"template\_" in rsconf.c and you will find the hardcoded ones.

Templates are specified by template() statements. They can also be
specified via $template legacy statements.

**Note: key elements of templates are rsyslog properties.** See the
:doc:`rsyslog properties reference <properties>` for a list of which
are available.

Template processing
-------------------

Due to lack of standarization regarding logs formats, when a template is 
specified it's supposed to include HEADER, as defined in `RFC5424 <https://tools.ietf.org/html/rfc5424>`_

It's very important to have this in mind, and also how to understand how 
`rsyslog parsing <http://www.rsyslog.com/doc/syslog_parsing.html>`_ works

For example, if MSG field is set to "this:is a message" and no HOSTNAME, 
neither TAG are specified, outgoing parser will split the message as:

::

  TAG:this:
  MSG:is a message


The template() statement
{'fraction_non_alphanumeric': 0.06342015855039637, 'fraction_numerical': 0.003020007550018875, 'mean_word_length': 4.353535353535354, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 1, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '650820', 'n_tokens_mistral': 700, 'n_tokens_neox': 665, 'n_words': 392}