I have configured rsyslog to log message to a centralised server it's working fine and I'm getting logs in my server's /var/log directory with seperate directory for all the clients based upon their ip addresses (ex: /var/log/ip-address/syslog.log) in it. It generates a file named syslog.log and logs are stored in it my question is can I configure rsyslog to generate all the traffic in different files like http in httpd.log mail in mail.log etc.
In your configuration file, you have the template defined: $template FILENAME,"/var/log/%fromhost-ip%/syslog.log"
When logging all facilities to that template, you are explicitly telling rsyslog to log everything to the file syslog.log. You need to set up seperate facility names for each application you want, ie. on, localhost, define http output as local7, and then on loghost, define a template like: