I have messages from multiple apache2 web servers logging to a rsyslog server. I've used a template to separate each /var/log/syslog file into its own folder based off of the ip address of the server
From my rsyslog server
#/etc/rsyslog.conf
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"
Later, I decided to add more logs to the logging.
From one of my web servers
#/etc/rsyslog.conf
$ModLoad imfile
$InputFileName /var/log/customFile.log
$InputFileTag custom-log
$InputFileStateFile myfile
$InputFileSeverity info
$InputFileFacility local3
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
local3.* @@192.168.1.20:514
Now, as expected, the logs from /var/log/customFile.log are going to the rsyslog server in /var/log/192.168.1.x/syslog.log.
What I'd like to happen is ALSO have those logs go to a separate file. So, on my rsyslog server, I'd like my /var/log/192.168.1.x/ directory to still have a syslog.log file, with all logs from that server, but also have a customLog.log file that is just the logs from the imfile info from /var/log/customFile.log
Is there any way to separate this out once it's on the rsyslog server?
