Linux – rsyslog – regex trouble

Our config has some extra error checking in it preventing random hosts from generating logs.

# Templates                    
$template RemoteHost,"/data/log/remote/%HOSTNAME%/%$YEAR%/%$MONTH%-%$DAY%.log"
$template Garbage,"/data/log/remote/GARBAGE/%HOSTNAME%/%$YEAR%/%$MONTH%-%$DAY%.log"

# Discard SNMPD Connection Messages
if $programname == 'snmpd' and ( $msg contains 'Connection from UDP' or $msg contains 'Received SNMP packet(s) from UDP' ) then ~

# Archival Storage
#    All Messages, locally and remote stored to these rules
if $hostname contains '.mydomain.com' or $hostname contains '.myotherdomain.com' or $hostname contains '.local' then { 
  *.* ?RemoteHost 
} else { 
  *.* ?Garbage
}

# If not sourced locally, stop processing message.
:source , !isequal , "syslog1" ~

You should be able to match the hostname of the system emitting your log. Isn't that enough?

Rsyslog has an option $PreserveFQDN on, to replace that hostname with your FQDN, which is probably better with syslog concentrators, ...

I suppose on the other end you have some logstash or elasticsearch? Either way, rsyslog also allows you to define templates such as:

template(name="jsonfmt" type="list" option.json="on") {
    constant(value="{")
    constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339")
    constant(value="\",\"@version\":\"1")
    constant(value="\",\"message\":\"") property(name="msg")
    constant(value="\",\"@fields.host\":\"") property(name="hostname")
    constant(value="\",\"@fields.severity\":\"") property(name="syslogseverity-text")
    constant(value="\",\"@fields.facility\":\"") property(name="syslogfacility-text")
    constant(value="\",\"@fields.programname\":\"") property(name="programname")
    constant(value="\",\"@fields.procid\":\"") property(name="procid")
    constant(value="\",\"@fields.mytag\":\"foobarStaticTag\"}\n")
}

local7.* @logstash.example.com:1514;jsonfmt
local7.* action(type="omelasticsearch"
       action.resumeretrycount="-1"
       dynSearchIndex="on"
       bulkmode="on"
       queue.type="linkedlist"
       queue.size="1000000"
       queue.dequeuebatchsize="1000"
       queue.workerthreads="2"
       searchIndex="logidx"
       server="esearchgw.example.com"
       template="jsonfmt")

Note that the sample logstash forwarder assumes your input definition includes codec => json. The foobarStaticTag being whatever Tag you wanted to add.