Lab4 or filtering

One thing you can try is the copy output plugin, linked here: https://docs.fluentd.org/output/copy

I will need to take some time to test it and post in a follow up, but it could potentially go:

source -> copy -> label1 -> filter -> file
            ----> label2 -> filter -> file

Pardon the wait, but here is an example of a single source breaking out into multiple labels with their own filters using the copy plugin to enable you to define multiple outputs. Within each <store> of the copy <match> directive, the relabel plugin then lets you assign labels to each of the copy outputs.

After the relabel plugins, a series of <label> directives with their own filters (using grep) and match outputs will route events to files:

<source>
  @type forward
  port 31604
</source>
 
<match *>
  @type copy
  <store>
    @type relabel
    @label output1
  </store>
  <store>
    @type relabel
    @label output2
  </store>
  <store>
    @type relabel
    @label output3
  </store>
</match>
 
<label output1>
  <filter>
    @type grep
    <regexp>
      key message
      pattern /cool/
    </regexp>
  </filter>
  <match>
    @type file
    path /tmp/output1
  </match>
</label>
 
<label output2>
  <filter>
    @type grep
    <regexp>
      key message
      pattern /warm/
    </regexp>
  </filter>
  <match>
    @type file
    path /tmp/output2
  </match>
</label>
 
<label output3>
  <filter>
    @type grep
    <regexp>
      key message
      pattern /hot/
    </regexp>
  </filter>
  <match>
    @type file
    path /tmp/output3
  </match>
</label>

You can test this particular pipeline with:

echo '{"message":"cool"}'| /opt/td-agent/bin/fluent-cat copytest -p 31604 --json
echo '{"message":"warm"}'| /opt/td-agent/bin/fluent-cat copytest -p 31604 --json
echo '{"message":"hot"}'| /opt/td-agent/bin/fluent-cat copytest -p 31604 --json

My grep filters are only looking at the key of message. If your incoming syslog events have a key containing the hostname (or you can grep your hostname from the message itself) then you can potentially achieve separate files for each of those machines.