Logs in one place

The collector gets a machine's lines only if that machine's rsyslog sends them itself — this takes a forwarding rule.

A rule's action can be another machine's address: then rsyslog sends a copy of the line over the network, which is forwarding (in the Wiki). The standard syslog port is 514, and the sign before the address sets the protocol:

*.* @@10.0.0.5:514      # all lines — over TCP
*.* @10.0.0.5:514       # all lines — over UDP

The same action in the newer syntax is action(type="omfwd" target="10.0.0.5" port="514" protocol="tcp"). Your own rule goes into a separate file in /etc/rsyslog.d ending in .conf: the package's files will be updated, and yours will stay. rsyslog reads its rules at startup, so an edit takes two commands: sudo rsyslogd -N1 checks the syntax of all the files (in the Wiki) without touching the running service, and sudo systemctl restart rsyslog applies the rules.

Only new lines are forwarded: what rsyslog wrote before the rule stays in the machine's own files. Delivery is checked with a test logger line — on the collector it lands in the directory named after the machine.