You definitely can with syslog-ng - not sure about rsyslog. To do it in syslog-ng, you simply add a \t in the tokens.

The syslog tool I use employs tab delimiters, here's the config for it:

destination d_logzilla { program("/www/logzilla/scripts/db_insert.pl" template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n") template_escape(yes) ); };

And here's a short video on how to configure syslog-ng from their site: http://www.logzilla.pro/syslog-ng-configuration

You definitely can with syslog-ng - not sure about rsyslog. To do it in syslog-ng, you simply add a \t in the tokens.

The syslog tool I use employs tab delimiters, here's the config for it:

destination d_logzilla { program("/www/logzilla/scripts/db_insert.pl" template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC\t$HOST\t$PRI\t$PROGRAM\t$MSGONLY\n") template_escape(yes) ); }; 

And here's a short video on how to configure syslog-ng from their site: http://www.logzilla.pro/syslog-ng-configuration