[logging] allow custom message format

[tobwen]

preface

I'm using conmon with podman. Since some containerized applications don't have good logging support, I'm using journald to capture the logs from conmon. For longtime storage, I'm processing the logs using rsyslog.

What's my issue?

Although conmon exported the container name and tags into journld, these details aren't part of the syslog export. It's impossible to filter out by container name. So rsyslog has to use the imjournal module, which makes all the tags available - but with way trouble in performance.

Jun  6 20:00:00 debian conmon[12975]: 2021-06-06 20:00:00.000 UTC [2] LOG:  database system is shut down

What might be a possible solution?

Allow configuring the syslog message.

Jun  6 20:00:00 debian conmon[12975]: $CONTAINER-NAME 2021-06-06 20:00:00.000 UTC [2] LOG:  database system is shut down

or

Jun  6 20:00:00 debian conmon-$CONTAINER-NAME[12975]: 2021-06-06 20:00:00.000 UTC [2] LOG:  database system is shut down

etc.

[portante]

In general, it will only create performance problems for conmon to spend time formatting log output. See #262 for details on the impacts that happen when a subsystem is involved in interpreting the byte stream.

Instead, moving to a raw format, as proposed in #265, and moving to a log reader of that format that transforms it for a target log receiver would be the most sustainable approach.