After lot of search on Google and reading all manuals available on man page and internet, I finally ask here.In my scenario, I have one rsyslog server working with mysql and a custom template  written which take logs, filter them and write them to mysql database My tmeplate is :    $template db_k,insert into  sensitive_logs(ID,TIME,message) values('%HOSTNAME%','%timegenerated:::date-mysql%','%msg%' ), sqlOutput:  Security | 20140401182028  |  Failed password for root from 192.168.1.113 port 34290 ssh2 I'd like to extract some words from the %msg%  Example: Failed,root,IP from this message part How can I do this?  
Extract particular words from Rsyslog %msg% facility
logs;rsyslog;filter