I am using Amazon Linux AMI release 2015.03, I am trying to configure rsyslog to redirect logs to a remote logging server (in this case, logstash) by dropping a conf file in /etc/rsyslog.d.
The remote logging configuration seems to work fine, but the logs are still written to /var/log/messages as well. Which is a problem because they are filling up the disk.
My conf file looks like this:
# Log docker generated log messages to logstash
:syslogtag, startswith, "docker" @x.x.x.x:5000
& ~
After some investigation with some other systems, I found that the rsyslog.conf file that exists by default in Amazon Linux is including this directive at the very end of the conf file:
$IncludeConfig /etc/rsyslog.d/*.conf
Other systems I have used have this directive higher up in the config file.. definitely before the default log configs. It appears to me that the defaults cannot be overridden because of this. Am I missing something?