Version 6.1.7 introduces syslog message classification via easy to create normalization rulebases. This functionality is build on top of liblognorm and libee and so rulebases can be shared with other tools that support liblognorm (like sagan). Also, we considerably speeded up TLS syslog message forwarding. This release also contains a number of important bug fixes.
Documentation on using log normalization and classification in rsyslog is currently sparse and being extended. We expect to have guides for important concepts available on www.rsyslog.com during the next week.
As always, feedback is appreciated.