Rsyslog filtering - rsyslog

Question

How can i forward different app/service log messages from one server to a central rsyslog server ? for clarification :
server1:swift(all in one)
server2:Rsyslog
swift log location :/var/log/swift/all/log(server1)
sshd log location:/var/log/secure(server1)
i want to store swift and sshd log in server2 in different location,the issue is server2 is taking logs in different location but both location is storing log from both all.log and secure !! how can i filter this ?
this is server1(swift) rsyslog.conf
#### MODULES ####
# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
#swift log forward to remote rsyslog server
$ModLoad imfile
$InputFileName /var/log/swift/all.log
$InputFileTag swift-log
$InputFileStateFile swift-log
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
local7.* #rsyslog.labtest.com
#sshd log forward to remote rsyslog server
$ModLoad imfile
$InputFileName /var/log/secure
$InputFileTag sshd
$InputFileStateFile var-log-secure
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
# Send over TCP
# local7.* ##rsyslog.labtest.com
# # Send over UDP
local7.* #rsyslog.labtest.com
#### GLOBAL DIRECTIVES ####
# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on
# File to store the position in the journal
$IMJournalStateFile imjournal.state
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
38,1 56%
}
and this is server2(rsyslog) rsyslog.conf
# rsyslog configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
#### GLOBAL DIRECTIVES ####
# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on
# File to store the position in the journal
$IMJournalStateFile imjournal.state
#### RULES ####
#:fromhost, isequal, "swift.labtest.com" /var/log/swift.log
#:fromhost, isequal, "swift.labtest.com" ~
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg :omusrmsg:*
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* ##remote-host:514
# ### end of the forwarding rule ###
#
#
$template Swift, "/var/log/swift/swift.log"
local7.* -?Swift
$template sshd, "/var/log/sshd/sshd.log"
local7.* -?sshd

Answer 1

As you read messages from files via imfile, you assign tags (swift-log and sshd respectively). You can use those tags on the receiving server for filtering. Something like:
if $syslogtag == "sshd" then {
action(type="omfile" file="/var/log/secure"
} else if $syslogtag == "swift-log" then {
action(type="omfile" file="/var/log/swift
}
Alternatively, you can also change the imfile configuration to assign different facilities to the tailed files (say local6 and local7). Then you could use the BSD-style config to do filtering like:
local6.* /var/log/secure # assuming local6 is assigned to sshd logs
local7.* /var/log/swift # and local7 for swift logs
You can find a list of properties you can use here: http://www.rsyslog.com/doc/master/configuration/properties.html
And information about using conditionals and other tricks here: http://www.rsyslog.com/doc/master/rainerscript/index.html
Though for some things you may need to upgrade to a recent version of rsyslog (e.g. 8.13 is the latest now but many distros still come with 5.x). You can find packages for the popular distros here: http://www.rsyslog.com/downloads/download-other/