destination d_gcpd { file("/var/log/gcpd.log" template("$YEAR/$MONTH/$DAY $HOUR:$MIN:$SEC $MESSAGE\n") ); }; filter f_gcpd { program(gcpd) or match("GCP:" value("MESSAGE")); }; log { source(src); filter(f_gcpd); destination(d_gcpd); };