You could use something like Simple Event Correlator to combine logs like this.
There is not a good way to do so inside rsyslog (and trying to do so would cause all sorts of grief with locking and multi-threaded processing)
best to do the combining before the logs go to rsyslog. David Lang _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
