如果要把不同服务器发送过来的日志保存到不同的文件, 可以这样操作:
:fromhost-ip, isequal, “192.168.0.160″ /var/log/host160.log
:FROMHOST-IP, isequal, “192.168.0.161″ /var/log/host161.log
:FROMHOST-IP, startswith, “192.168.1.” /var/log/network1.log
:FROMHOST-IP, startswith, “192.168.2.” /var/log/network2.log
$EscapeControlCharactersOnReceive off #关闭rsyslog默认转译ASCII<32的所有怪异字符，包括换行符等
$template tocFormat,"%syslogtag%,%FROMHOST-IP%,%msg%\n"
$template zjzc-flow01,"/data01/applog_backup/zjzc_log/zj-flow01-catalina.out.%$year%-%$month%-%$day%" #定义TC：日志存放路径
:syslogtag,isequal,"zjzc-flow01" -?zjzc-flow01;tocFormat
#if $syslogfacility-text == 'local5' and $msg startswith 'zjzc-flow01' then -?zjzc-flow01;tocFormat
dr-mysql01:/data01/applog_backup/zjzc_log#
