I want to write remote logs to the /data directory
# cat /etc/rsyslog.d/default.conf
#### GLOBAL DIRECTIVES ####
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template myFormat,"%timestamp% %fromhost-ip% %syslogtag% %msg%\n"
$ActionFileDefaultTemplate myFormat
$template RemoteFirewallLogs,"/data/%fromhost-ip%/%$YEAR%-%$MONTH%/%$YEAR%-%$MONTH%-%$DAY%.log"
local2.* !isequal, "127.0.0.1" ?RemoteFirewallLogs
& ~
As a result, the remote log is still written to /var/log/messages, which does not meet my expectations!