Understanding rsyslog log format and filtering

Question

I am working on filtering logs from syslog and forwading to another log.

I am able too capture/filter the log based on "internal-sftp". By using

if $programname == 'internal-sftp' then /var/log/sftp/sftp.log

above is working.

But I am unable to filter based on this "lstat name". I troed pri, syslogtag et., below is the log format.

Apr 24 02:16:30 ip-10-0-10-22 internal-sftp[4714]: lstat name "/settlement/universalpay/test_deletez.log"

So, how can I filter the line containing lstat name based on condition. Which properties i should use.

Below is sample code which I am trying.

if $programname == 'internal-sftp' then {
        if $syslogfacility-text contains 'lstat name' then {
                action(type="omfile" file="/var/log/sftp/sftp_lstat_files.log" template="outfmt")
        }
        action(type="omfile" file="/var/log/sftp/sftp.log" template="outfmt")
        & stop 
}

Answer 1

Bala,

Could you please check as below

if $msg startswith ' lstat name' then { ....

make sure that you have space as shown above infront of ' lstat name'