linux-formula/linux/files/heka.conf

input:
  linux_rsyslog_syslog:
    engine: logstreamer
    log_directory: /var/log
    file_match: syslog\.?(?P<Index>\d+)?(.gz)?
    priority: ["^Index"]
    decoder: RsyslogDecoder
  linux_rsyslog_auth:
    engine: logstreamer
    log_directory: /var/log
    file_match: auth\.log\.?(?P<Index>\d+)?(.gz)?
    priority: ["^Index"]
    decoder: RsyslogDecoder
  linux_rsyslog_kern:
    engine: logstreamer
    log_directory: /var/log
    file_match: kern\.log\.?(?P<Index>\d+)?(.gz)?
    priority: ["^Index"]
    decoder: RsyslogDecoder
decoder:
  rsyslog:
    engine: rsyslog
    template: \%TIMESTAMP\% \%HOSTNAME\% \%syslogtag\%\%msg:::sp-if-no-1st-sp\%\%msg:::drop-last-lf\%\n
    hostname_keep: TRUE
    tz: Europe/Prague