moved $PreserveFQDN at the top

This statement should be the first. As explained at https://wiki.archlinux.org/index.php/rsyslog:
"If you want to have full hostnames in logs, you need to add $PreserveFQDN on to the beginning of the file (before using any directive that write to files). This is because, rsyslog reads config file and applies it on-the-go and then reads the later lines."