[rsyslog-notify] Forum Thread: Re: omfile with DynFile & %syslogfacility-text% - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25275#p25275

Message: 
----------
logstash is able to filter based on the facility/severity in the PRI
section (this is how syslog facility/severity filtering has normally
worked, it's a syslog-ng oddity to have it in the body of the message as
well, and violates the RFCs)

But you can create a custom template and put whatever fields whereever you
want in the message.