http://www.rsyslog.com/doc/v8-stable/configuration/modules/ommysql.html

文档中：

Note rsyslog contains a canned default template to write to the MySQL database. It works on the MonitorWare schema. This template is:

$template tpl,”insert into SystemEvents (Message, Facility, FromHost,

Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values

(‘%msg%’, %syslogfacility%, ‘%HOSTNAME%’, %syslogpriority%,

‘%timereported:::date-mysql%’, ‘%timegenerated:::date-mysql%’, %iut%,

‘%syslogtag%’)”,SQL

As you can see, the template is an actual SQL statement. Note the ”,SQL” option: it tells the template processor that the template is used for SQL processing, thus quote characters are quoted to prevent security issues. You can not assign a template without ”,SQL” to a MySQL output action.

If you would like to change fields contents or add or delete your own fields, you can simply do so by modifying the schema (if required) and creating your own custom template.

请问如何修改template或者自定义template呢？

已解决。定义template：

$template tpl,”insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (‘%msg%’, %syslogfacility%, ‘%FROMHOST-IP%’, %syslogpriority%, ‘%timereported:::date-mysql%’, ‘%timegenerated:::date-mysql%’, %iut%, ‘%syslogtag%’)”,SQL

设置ommysql后面直接加上 “;tpl” #template name