Post History
You said rsyslog specifically. Hopefully you are using a version new enough to use the advanced syntax (aka RainerScript). 1 Would something similar to the following work for you? $EscapeControlC...
Answer
#1: Initial revision
by
bgstack15
·
2022-12-15T02:02:52Z (almost 2 years ago)
You said `rsyslog` specifically. Hopefully you are using a version new enough to use the advanced syntax (aka `RainerScript`). [1]
Would something similar to the following work for you?
$EscapeControlCharactersOnReceive off
$template RemoteHost,"/var/log/remote/%HOSTNAME%/application.log"
if ($hostname != 'localhostnamehere') and ($hostname != 'localhost.fqdn') then ?RemoteHost
if ($hostname != 'localhostnamehere') and ($hostname != 'localhost.fqdn') then stop
Followed by whatever else you want. This is from something I wrote for myself in 2016 on CentOS 7. I have no idea if the EscapeControlCharactersOnReceive matters for your situation, but it was part of my template back then.
[1]: https://www.rsyslog.com/doc/master/configuration/conf_formats.html