So I'm extremely new to rsyslog (recently switch from syslog-ng) and I really like that I can have dynamic filenames... My work has recently started using docker and they're sending a lot of fields in the syslogtag to a remote host. So instead of setting up filters for every instance, I'm trying to write a dynamic filter to parse out the relevant details and put it to it's own log/directory such as /var/log/docker/app name/syslog.log

I have the 'app name' working when they're providing the proper delimiters between the fields but when they're not using the proper one, the regex is returning **NO MATCH** and is putting everything to a '/var/log/docker/**NO MATCH**/syslog.log'. Using the **NO MATCH** directory is not an issue but grouping every remote host together in one file is. Is there a way to test if the regex returned no match and then have it change the filename from 'syslog.log' to '%hostname%.log' ?

1 Answer 1


I am not an expert, but you can start with this: you will need to repeat your regexp (I don't know how you can evaluate a template to get the **NO MATCH** string). For example, say your "appname" part is matched by the regexp [a-z]+:, then you can write

$template nomatch,"/var/log/docker/nomatch/%hostname%.log"
if (not re_match($msg, "[a-z]+:")) then {
   action(type="omfile" dynaFile="nomatch")

The $template describes your wanted filename, the if tries to find the match, and then does the action of writing to the file, with no further handling of this message. The action() parameters are described here in RainerScript.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .