I have a lot of incoming syslog messages on my rsyslog server. It's a stormshield that sends different categories of messages (connection, web, alarm, ...)

I can't configure a different facility for each category so I need to use regular expression to split incoming messages in differents files.

All messages are different and have more or less fields in the message, but there is one field logtype to identify the category :

Syslog message 
Msg = bullshitcontentbullshitcontent logtype:"connection" bullshitcontentbullshitcontent

So the question is :

How can I collect the string of the logtype field with a POSIX regular expression that is understandable by rsyslog and - if you know how - split in different files depending of the value of the logtype?

1 Answer 1


I know this is a little late, but it is possible. I dont know how you are getting these logs (a quick search suggested network, maybe), but I've got a similar setup. You can use rulesets, to make (funnily enough) new sets of rules that aren't used as default. And in the inbuild scripting language RainerScript, theres an re_match function, that returns true or false.

ruleset(name="stormshield") {
    if re_match($msg, "your POSIX ERE regex") then {
        action(type="omfile" file="/your/file/name/here")
    } else if re_match(...) then { ... }
    else { ... }

$msg is a reference to to current log.

omfile is for output module, so if you need databases or anything, theres other options too.

And once you have finished the if..else if...else other things can go there. the stop is needed to discard the msg once its finished with, otherwise it'll go to other rules too. I think you can add a tilde ~ after the action too for this, but you'll have to check.

How to direct the logs to the ruleset (bind to it as the docs say) depends on the source. for network or file sources, theres the input function, and input modules such as "imtcp" and "imfile" which have a ruleset parameter. You may have to get extra packages for some of the modules:

input(type="imfile" File="/input/file/here.log" Tag="..." Ruleset="ruleset name")
input(type="imtcp" Port="1234" Name="name" Ruleset="ruleset name")

and finally if you need to send a particular facility you may be able to use call: local0.* call rulesetName (no quotes for the name it seems) for example (choose what needs logging as required)

I think I've got much of this ok. I've just been looking at the conf files so apologies for any errors..

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .