think this might work, time to begin testing

root/etc/rsyslog.d/10-listeners.conf

@@ -0,0 +1,9 @@
+$ModLoad imudp.so
+$UDPServerRun 514
+
+$ModLoad imtcp
+$InputTCPMaxSessions 100
+$InputTCPServerRun 514
+
+$ModLoad imrelp
+$InputRELPServerRun 20514

root/etc/rsyslog.d/20-writedisk.conf

@@ -0,0 +1,7 @@
+$PreserveFQDN on
+
+$template ls_json,"{%timestamp:::date-rfc3339,jsonf:@timestamp%,%source:::jsonf:@source_host%,\"@source\":\"syslog://%fromhost-ip:::json%\",\"@message\":\"%timestamp% %app-name%:%msg:::json%\",\"@fields\":{%syslogfacility-text:::jsonf:facility%,%syslogseverity-text:::jsonf:severity%,%app-name:::jsonf:program%,%procid:::jsonf:processid%}}\n"
+
+$template systemjsonfile,"/var/logs/%$year%%$month%/%$year%%$month%%$day%.%HOSTNAME%.system.json"
+
+*.* ?systemjsonfile;ls_json

root/etc/service/logspout/run

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+/usr/local/bin/logspout syslog://127.0.0.1:514

root/etc/service/rsyslog/run

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+chgrp syslog /var/logs
+chmod g+w /var/logs
+
+exec rsyslogd -n