Sieve like
From rsyslog wiki
A quick sample...
require ["fileinto", "kernel", "mysql", "postgres"];
if field :contains "severity" ["emerg"] {
fileinto "/var/log/emerg";
stop;
}
if field :contains "tag" ["rsyslog"] {
fileinto "/var/log/rsyslog";
fileinto "dbi://user:pass@hostname:port/options/db/table";
stop;
}
if field :contains "host" ["remotehost"] {
fileinto "tcp://remotehost2:port/options";
fileinto "udp://remotehost2:port/options";
stop;
}
