Rsyslog Template - Save to file with only message

Question

Trying to create an RSYSLOG template which does two things:

• Saves to a specific file using the %hostname%
• Saves only the raw syslog message ("%msg%")

I have found examples of how to do each individually:

Saving to hostname file:
$template sampleTemplate2, "/var/log/%HOSTNAME%.log"

Saving with syslog content only:
$template sampleTemplate,"%msg%\n"
*.* /var/log/test.log;sampleTemplate

However, trying to do the below fails:

$template sampleTemplate,""%msg%\n"
*.* /var/log/%hostname%.log;sampleTemplate

Answer 1

You must define dynamic log file name in template and then use template for this purpose. You must use a question mark prefix (?) for template.

$template sampleTemplate2, "/var/log/%HOSTNAME%.log"
$template sampleTemplate,"%msg%\n"
*.* ?sampleTemplate2;sampleTemplate

reference for dynamic file usage