rsyslog not writing dynamic log file

Question

The systemd unit files for my Java apps (on Ubuntu 18.04) appear to be working - I had set stdout and stderr to be sent to syslog and the log entries were appearing in /var/log/syslog.

However I want to use dynamic names, hence I added /etc/rsyslog.d/10-myapp.conf containing:

$CreateDirs on

:programname, startswith, "myapp-" {
  /var/log/apps/$programname.log
  stop
}

I then restarted rsyslog....and got a file named $programname.log in the directory.

I suspect that there may be an issue with how I have specified the dynamic file name - I see elsewhere people using a different syntax for selecting the message along with %...% around the variable name. However trying the following (and restarting rsyslog) did not help:

:programname, startswith, "myapp-" {
  "/var/log/apps/%programname%.log"
  stop
}

That gave me a file named %programname%.log

Answer 1

To use dynamic filenames you need to go via a template. This names the string (usually DynFile in examples) and will interpolate the %property% values in the string when used. To use the template in legacy syntax you need to prefix it with ?.Try

$template DynFile,"/var/log/apps/%programname%.log"
:programname, startswith, "myapp-" {
  ?DynFile
  stop
}

---

Non-legacy syntax is a bit more explicit and can sometimes be more readable. You are actually using the builtin omfile module. Beware, templates have 2 different uses: as dynamic filenames, and as a format for the data to write. For simple strings, though, they are defined in the same way, eg:

template(name="myfile" type="string"
     string="/var/log/apps/%programname%.log")

if ($programname startswith "myapp-") then {
     action(type="omfile" dynaFile="myfile")
     stop
}

Keywords like dynaFile need to be spelled exactly. Note that action() has a template=... keyword option. That is to provide a template for the data written in the file.