Friends ,

In rsyslog server , I have to create two separate database with two separate tables and want to keep rsyslog client end log onto this separate database tables . In this reason I have to configure rsyslog server below way :

#Template create name 'events' and 'linux'

$template events,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag, ProcessID) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD[a-zA-Z\/]+)(\[[0-9]{1,5}\])*:--end%', '%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",sql
$template linux,"insert into SystemLinux (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag, ProcessID) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag:R,ERE,1,FIELD[a-zA-Z\/]+)(\[[0-9]{1,5}\])*:--end%', '%syslogtag:R,ERE,1,BLANK:\[([0-9]{1,5})\]--end%')",sql

#define source with if condition
if ($source == '172.20.210.48') then mmysql:127.0.0.1,Syslog,rsyslog,123456;events

if ($source == '192.168.1.41') then mmysql:127.0.0.1,loganalyzerdb,loganalyzer,123456;linux

(#Here ip 172.20.210.48 and 192.168.1.41 are client server)

But problem is all client's log goes to the table 'SystemEvents; of the 1st database .

Would anybody please help me how can I send separate client's log onto separate tables of the two database ?

Waiting for kind reply ... ...

What file(s) are you editing exactly?
I never had any luck messing with defaults. Leave those alone is my opinion.
I made progress setting what I call "watchfiles" sent to a remote rsyslog server.

It is not clear to me that LogAnalyzer using mongodb can be split like you want.
And it is LogAnalyzer using mongodb?
Version(s)? Method of installation?
Did it ever work? What have you read? Where did you read it?