I have some syslog traffic being processed by rsyslog and I'd like to set up filters to store the logs based on the IP addresses of the source devices. I have a large number of devices and would prefer to avoid creating a rule for each device. The IP scheme is consistent enough that I would think I could handle everything with a single rule but I'm having trouble getting it to work.
Here are a couple of (failed) examples of what I'm trying to accomplish:
:FROMHOST, regex, "10\.[0-9]+\.1\.2" -/var/log/test.log
& ~
or
if ( re_match($fromhost-ip, '10\.[0-9]+\.1\.2') ) then { -/var/log/test.log }
& ~
Basically, the IP scheme for these devices will always be 10.*.1.2, where * is a 2 digit number corresponding to the location of the device.
Can someone give me an idea of where I'm going wrong with this?
Thank you!