I have configured rsyslog and set following value:

$template serverlog, "/var/log/TEST/%HOSTNAME%/server.log"
local4.* ?serverlog

Now the code will create folder based on %HOSTNAME%, but I would like to create folder First on server name (company name) and then HOSTNAME.

For example: I have 3 servers for the 2 different companies ABCD and xyz, and their 3 server names (hostname) is: abcdapp-1t abcdapp-2t abcdapp-3t

xyzapp-1t xyzapp-2t xyzapp-3t

Now if I run the above template, it will create different folders according to hostname under /var/log/TEST/ , but I need to create 2 different folders ABCD and XYZ and relative hostname will go under specific directory and create subfolder.

For example: required to looks like this:



As I have more than 15 different servers of clients, I can not do it in one statement.

How can I use If else IF statements in rsyslog , so I can filter by HOSTNAME and move to specific folder?

Is there any suggestion?

1 Answer 1


If we assume your HOSTNAME field is of the form alphabetic-restofname and the initial alphabetic part is your company name, you can separate it from the field using the regexp property replacer. Change your template to

$template serverlog, "/var/log/TEST/%hostname:R,ERE,1,FIELD:([^-]+)--end%/%HOSTNAME%/server.log"

The regexp pattern is ([^-]+), meaning one or more characters not including -. The rest specifies that only the first capturing group ,1 of the ,ERE extended regexp syntax should be kept. If there is no match the whole FIELD is kept.

You must have rsyslog version 3.19.5 or later, or 4.1.5 or later. See the above link for changing to uppercase if wanted.

Alternatively, you should be able to do what you want, if your rsyslog is version 7 or later, using RainerScript as follows:

$template myplate,"/var/log/TEST/%$.customer%/%hostname%/server.log"
if ($hostname startswith "abcd") then set $.customer = "ABCD";
if ($hostname startswith "xyz") then set $.customer = "XYZ";
action(type="omfile" dynaFile="myplate")

This creates a template using a local variable $.customer. The variable is set for each message when the hostname is matched by each if statement. The action writes the message to the calculated file. You can add another if statement for each customer.

  • Thanks for the response. But I am not having fix pattern, having different host name and client name ..For example... HOSTNAME is gooapp-1t and Client name is Googlie , .... HOSTNAME is yahapp-1t and Client name is Yahooiie. Please provide any suggestion/ solution if possible.
    – varun
    Nov 10, 2016 at 9:39
  • As a simple solution you can use the regexp answer and then simply setup symbolic links from /var/log/TEST/gooapp to the real directory var/log/TEST/Googlie and so on.
    – meuh
    Nov 10, 2016 at 9:48
  • Thanks you for the quick reply, but i am having more than 50 Clients and each having test , prod , dev app server. so its very difficult for me to link. Is there any way i can write a simple IF elseIF code in rsyslog.conf file...For Example .. IF HOSTNAME = gooapp-1t then set Clientname = Googlie .......... and i will use variable Clientname under....$template serverlog, "/var/log/TEST/Clientname/%HOSTNAME%/server.log" ........some thing like this
    – varun
    Nov 10, 2016 at 10:55
  • I updated the answer with an alternative solution.
    – meuh
    Nov 11, 2016 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .