Rsyslog Client nginx conf

nginx-logs.conf

$ModLoad imfile
$InputFilePollInterval 10 
$PrivDropToGroup adm


#NGINX access file:

# Path to the file which you want to monitor
$InputFileName /home/logs/nginx-access.log

# The tag apache can be changed to whatever you'd like note this is referenced in the if $programname
# It can be used as %app-name% in template. We can also use %syslogtag% but it also returns ":"
$InputFileTag nginx-access:    

# Name of spool file when remote server is not reachable
$InputFileStateFile stat-nginx-access

# Priority of Syslog event. Can be used as %syslogpriority% in template
$InputFileSeverity info

# https://community.loggly.com/customer/portal/articles/1225986-rsyslog-configuration-for-file-monitoring

$InputRunFileMonitor

#NGINX Error file: 
$InputFileName /home/logs/nginx-error.log
$InputFileTag nginx-error:   
$InputFileStateFile stat-nginx-error
$InputFileSeverity error
$InputRunFileMonitor

#PHP Error file: 
$InputFileName /home/logs/php-error.log
$InputFileTag php-error:
$InputFileStateFile php-nginx-error
$InputFileSeverity error
$InputRunFileMonitor

#Add a tag for apache events
$template CPGLogFormat,"%HOSTNAME% %syslogpriority% %syslogfacility% %app-name% %msg% \n"


# The @@ in the last line of the configuration tells rsyslog to send data via TCP. Use @ for UDP
if $programname == 'nginx-access' then @185.38.44.97:514;CPGLogFormat
if $programname == 'nginx-access' then stop
if $programname == 'nginx-error' then @185.38.44.97:514;CPGLogFormat
if $programname == 'nginx-error' then stop
if $programname == 'php-error' then @185.38.44.97:514;CPGLogFormat
if $programname == 'php-error' then stop