So I'm extremely new to rsyslog (recently switch from syslog-ng) and I really like that I can have dynamic filenames... My work has recently started using docker and they're sending a lot of fields in the syslogtag to a remote host. So instead of setting up filters for every instance, I'm trying to write a dynamic filter to parse out the relevant details and put it to it's own log/directory such as /var/log/docker/app name/syslog.log
I have the 'app name' working when they're providing the proper delimiters between the fields but when they're not using the proper one, the regex is returning **NO MATCH** and is putting everything to a '/var/log/docker/**NO MATCH**/syslog.log'. Using the **NO MATCH** directory is not an issue but grouping every remote host together in one file is. Is there a way to test if the regex returned no match and then have it change the filename from 'syslog.log' to '%hostname%.log' ?