diff --git a/_modules/rsyslog_util.py b/_modules/rsyslog_util.py
new file mode 100644
index 0000000..d58a1c4
--- /dev/null
+++ b/_modules/rsyslog_util.py
@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+
+import os
+
+
+def syslog_file_match(output):
+    """
+    Return patterns to be used in logstreamer file_match config params.
+
+    For example the function may return this dict:
+
+    {
+      "/var/log": "kern\.log|auth\.log|syslog|mail\.log|mail\.err"
+    }
+    """
+    file_match = {}
+    for name, config in output.get('file', {}).items():
+        if not config.get('enabled', False):
+            continue
+        logdir = os.path.dirname(name)
+        pattern = os.path.basename(name).replace('.', '\.')
+        if logdir in file_match:
+            file_match[logdir] = file_match[logdir] + '|' + pattern
+        else:
+            file_match[logdir] = pattern
+    return file_match