Rsyslog to Promtail - Cursed Log - what Template?

Hello everyone,

I seem to be a bit clueless…

I want to push the log data from our Citrix Netscalers into Grafana Loki. To do this, I intended to use the following path:

Netscaler → rsyslog → promtail → Loki

The logs from the Netscaler are not properly formatted and look like this in raw form:

Debug line with all properties:
FROMHOST: ‘X.XX.0.0’, fromhost-ip: ‘X.XX.0.0’, HOSTNAME: ‘X.X.0.0’, PRI: 134,
syslogtag ‘’, programname: ‘’, APP-NAME: ‘’, PROCID: ‘-’, MSGID: ‘-’,
TIMESTAMP: ‘Jan 22 13:38:12’, STRUCTURED-DATA: ‘-’,
msg: ’ 01/22/2024:13:45:12 GMT hostname 0-PPE-0 : <log> ’
escaped msg: ’ 01/22/2024:13:45:12 GMT hostname 0-PPE-0 : <more log > ’
inputname: imudp rawmsg: ‘<134> 01/22/2024:13:45:12 GMT hostname 0-PPE-0 : <more log>’

Because the APP-NAME is empty and no STRUCTURED-DATA is provided, promtail cannot send it to Loki.

So, I need a template for rsyslog to format the log message correctly…

And here’s where I’m stuck. How should it look? do have to di it in rsyslog? or could it be done in promtail?