[syslog-ng] Syslog-NG Mysql Parsing to separate column

Sync IT syncit-bd at live.com
Tue Mar 31 10:40:25 UTC 2020

I am new to syslog-ng. I am receiving my logs perfectly to mysql. now i want to separate the message log into different column in mqsql. Currently i am receiving messages like this
R2_DST_RTR forward: in:<pppoe-user1> out:vlan100-Default-Internet, src-mac 11:22:33:44:55:66, proto TCP (ACK,FIN),>, NAT (>>, len 52

This is my syslog-ng config

source s_net{
udp( );

destination d_mtksql {
host("localhost") username("dbuser") password("dbpasss")   database("syslog")
columns( "id int(11) unsigned not null auto_increment primary key", "host varchar(40) not null", "date datetime", "message text not null")
values("0", "$FULLHOST", "$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC", "$MSG")

log {

i want to separate the message data in different column like- time,username,src mac,src ip,dst ip, nat ip. Any idea how can i achieve that? I am not a pro so if possible kindly write in details how to parse them. Many thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20200331/01ca324f/attachment.html>

More information about the syslog-ng mailing list