Still no sucess, when i include the if part (as per below) nothing works.
rsyslogd: version 8.2102.0-5.el8, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: error during parsing file /etc/rsyslog.d/tomcat.conf, on or before line 9: syntax error on token 'regex' [v8.2102.0-5.el8 try https://www.rsyslog.com/e/2207 ]
module(load="imfile" PollingInterval="1") #needs to be done just once
#File 1
input(type="imfile"
File="/tomcat/logs/catalina.out"
Tag="catalina"
Severity="info"
Facility="local1")
if $msg regex "(?sm)org\.apache\.jasper\.JasperException:.* java\.lang\.NullPointerException[\r\n]{1,2}(\s+(?:at )?[^\s]+[\r\n]{1,2}){1,}" then {
action(type="omfwd" target="192.168.0.1" port="514" protocol="udp" facility="local1" severity="err")
}
local1.* @192.168.0.1:514