Search code examples
loggingerror-loggingrsyslogsyslog-ng

Rsyslog segregate logs for wildcard files

I have a central server to log my different application logs, i forward the logs using rsyslog's(8.36) wildcard(/var/log/sample/*.log), i'd like to segregate the logs on my central server based upon the filename being monitored, how do i go about it?

Forwarder:

`input(type="imfile" File="/var/log/sample/*.log"
Tag="sample-req_params.log"
StateFile="/var/spool/rsyslog/app-req_params"
Severity="error"
Facility="local7")
*.* @@X.XX.X.XXX:514`

Receiver:

`$template MYFILENAME,"/var/log/sample/%programname%.log"
if $programname contains 'sample' then ?MYFILENAME`
Solution

  • Sorry for this not being the greatest answer, but I hope I can push you into the right direction. The default templates do not transmit the file name. On the original system, however, it is available as imfile metadata. You need to define a template on the client side that contains that metadata and the use it on the server side to extract the file name.