Make sure the target folder exists, e.g.,
ls -al /data/logs/
Allow rsyslog to listen on port 514, disable rsyslog facilities local1,2,3 on ‘messages’ and enable it only for /data/logs/APPNAME/…,
cd /etc/ cp -pi rsyslog.conf rsyslog.conf.dist vi rsyslog.conf *.info;mail.none;authpriv.none;cron.none;local1.none;local2.none /var/log/messages # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") # provides TCP syslog reception module(load="imtcp") input(type="imtcp" port="514") local1.* /data/logs/APPNAME/special1.log local2.* /data/logs/APPNAME/special2.log service rsyslog restart