I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for example ::IPT::LOG::.How can I configure rsyslog to redirect messages tagged that way into a separate log file? Man page for rsyslog looks too cryptic to me.
How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?
logs;iptables;rsyslog
In addition on selector-based filtering, rsyslogd can filter on patterns found in log message properties. To accomplish what you are trying to do, you can create a property-based filter to match the string you are using in your iptables rules. If you were to use --log-prefix unique_prefix:  in your iptables rule, you would need to add this to rsyslog.conf::msg,startswith,unique_prefix /var/log/iptablesThis rule will test log messages for your prefix and send them to /var/log/iptables (in addition to wherever else rsyslog is configured to send them). If you need to have the messages appear in /var/log/iptables but not elsewhere, place the new rule above others, and follow it with a line containing & ~. Complete example::msg,startswith,unique_prefix /var/log/iptables& ~## The rest of my rules appear below# ...*.info;mail.none;authpriv.none;cron.none                /var/log/messagesRsyslog rules can have multiple actions. Subsequent actions are defined on new lines beginning with an ampersand (&). In the example above, the first rule has two actions: send output to /var/log/iptables, and then discard message (~). See rsyslog docs on actions and filters for more information on the rules in this answerEdited to use startswith rather than contains for performance considerations. Since the iptables --log-prefix is indeed a prefix, and thus will be at the start of the message.