I have added my first expression based filter in my /etc/rsyslog.conf file. The rule seems to work but each time it writes two duplicates of each log entry to /app/rsyslog/myApp.log I was wondering if it is 'and' cause trouble and tried to put () around the expression, makes no difference.. Any advise will be very much appreciated. thanks!
RULES
#myApp logs from the remote host - the new rule that causes duplicates
if ($hostname == '172.x.x.x’ and $app-name == 'myApp') then /app/rsyslog/myApp.log
& stop
#some other logs from the same remote host - The existing rule with no problem
:hostname, isequal, "'172.x.x.x’ " /app/rsyslog/NOTmyApp.log
& ~
Then I reduce the condtion to one only as below.. it does not fix the problem. if $app-name == 'myApp' then /app/rsyslog/myApp.log
It seems now to me, any expression based filter will trigger the duplication.