Using more than one config file in /etc/rsyslog.d/

[nilo72]

As I understand it right everything is written to the rsyslog:target_file.

Do you plan a feature to split a rsyslog configuration into more than one config file?

[bschonec]

Does #98 address your question?

rsyslog::config::actions:
  all_logs_to_siem:
    type: omfwd
    facility: "*.*"
    target: siem.conf       # Create this configuration in its own file.
    config:    
      target: "siem.example.com"
      protocol: udp

[root@rhel8 rsyslog.d]# ls -l /etc/rsyslog.d/siem.conf 
-rw-r--r--. 1 root root 127 Jun 22 08:21 /etc/rsyslog.d/siem.conf

[traldi]

Hi,
I have a similar question:
I would like to put a general config in 50_rsyslog.conf with standard module and some prifilts and actions. (I did this)
I have another puppet module for example ngnix.pp which I would like to use a different file like /etc/rsyslog.d/60_ngnix.conf with for example a local logger like:

class { 'rsyslog::config':

'expression_filters' => {

'complex_filer' => {

   'conditionals' => {

      'conntrack' => {

        'expression' => 'prifilt("local1.*")'
        'tasks' => [

          'action' => {
           'type' => 'omfile',
          'config' => {'file' => '/var/log/ngnix.log'}
           }

         ]

      }

   }

 }

}
}

So I would have in all hosts the 50_rsyslog.conf and only in few host also the file /etc/rsyslog.d/60_ngnix.conf
with this content:
if prifilt("local1.*") then { action(type="omfile" file="/var/log/ngnix.log") }