Actually, our setup is bit complex, when a customer orders few boxes, we reserve those boxes and all of those boxes will have our management VM running(comprised of many small applications), none of the application that sends it's logs to Syslog Server writes customer-uid in it's log file. Our final goal is to be able to search all layers of logs that the request passes through in splunk based on customer ID, whenever a customer reports an issue. Like I said management VM runs many services and it's not possible to make code level at this stage to have applications write customer_id thats why I was thinking if at the time of assigning boxes we can just update rsyslog client config to just include customer_id, it will be easiest solution.
I tried to use '$InputFileTag' to define the customer_id but it doesn't accept more than 32 character and our customer ID has 36 character.
... View more