What I have configured, which I do not like as it is not dynamic, is added:
_meta = heavy_forwarder::rsyslog.fqdn
To the /etc/system/local/inputs.conf file on each of the rsyslog hosts under the default stanza. I had to do this due to wanting to use the host regex on the monitor path for hostname. Also had to add the fields.conf on the IDXC/SHC members to be able to search for them properly. Don’t get me wrong, this works fine... It is just not as dynamic and requires me to start using puppet (which is ok, it is just another place for configurations that IMO should/could be managed by the deployment server dynamically via inputs.conf in specific inputs apps) to dynamically generate the rsyslog fqdn for the _meta tag I want to create in the system/local/inputs.conf file (per host) as new hosts are spun up.
This just seems like an oversite (not being able to use system variables in config files) - especially for systems running as Heavy Forwarders on Syslog hosts.
... View more