Filter Rsyslog Messages by Tags – How to Guide

bashloggingrsyslogsyslog

I have several applications and scripts that I want to redirect the output to custom files.

I launch those applications using 

command | logger -t TAG

I would like to filter these messages based on their tags and redirect them to different files.
I don't want to use bash redirection as those applications are mainly long running process and need proper log rotation.

I have tried to add a custom filter in /etc/rsyslog.d/60-myfilter.conf ;

if $syslogtag == 'giomanager' then /var/log/giomanager.log

What am I doing wrong ?
What is the proper way to filter based on the tag or is there a better option to have similar result?

Best Answer

I've not used if like that (or syslogtag) but I have used :<blah>,<condition> ... (in particular :msg, contains,...) but try

:syslogtag, isequal, "giomanager:" /var/log/giomanager.log
& stop

The & stop (Or, & ~ in rsyslog v6 and older (Such as on RHEL6)) causes the matched message to be discarded after logging otherwise it will be further parsed by other rules.

Update: tested and

The syslogtag contains a : and should be enclosed in "" rather than ''

Related Topic