Specify Different Facility Per Logfile about remote_syslog HOT 3 CLOSED

@MattMencel could you explain more about how you want to use this? That is, what's the back story for why you want a facility per log file, rather than using the log file name (in syslog parlance, tag) as a filter later?

from remote_syslog.

On my central logging host (rsyslog) I originally thought I could only filter on facility. I ended up upgrading rsyslog to give me more filtering flexibility (from v5 to v7), but likely my issue was I didn't fully understand the rsyslog filtering rule language. I got it working eventually. I filter on the log source name sent with each log entry.

Still...being able to for example.... send remote maillogs as local3, authlogs as local4, http_access logs as local5, etc.... seems like it might be faster than parsing each log line for the data I am filtering on. Could be I'm wrong and it may not matter anyway. I'm sending multiple GBs of log data per hour to my log host now and it doesn't seem to faze it one bit. So maybe performance is not an issue.

from remote_syslog.

Thanks for the extra detail, @MattMencel. I think that's a good summary and would recommend filtering that way (tag/filename or full string) rather than by facility or severity, unless those really are the most granular/appropriate attributes for what you're looking for.

Performance is not an issue, or at least the difference between comparing the message and comparing the facility isn't going to make a difference.

from remote_syslog.