Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my rsyslog configured to send logs from a logfile to a remote host

$InputFileName /var/log/app/app.log
$InputFileTag app
$InputFileSeverity info
$InputFileFacility local7
local7.*@ remoteip

Before sendining the log from app.log I need to filter the content to decide whether to send the log or not.
How can I filter log content before sending?

share|improve this question
On what condition? – Danila Ladner Sep 26 '13 at 22:23
if message contains $string then discard else forward to remote ip – user2284355 Sep 26 '13 at 22:28
Is it possible to apply regex to the comparison? – user2284355 Sep 26 '13 at 22:29
I am trying to do this but I am getting syntax errors on syslog start:if $msg contains " 514" then ~ else local7.* @ip – user2284355 Sep 26 '13 at 22:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.