filter f_synoservice { match("synoservice:" value("MESSAGE")); }; destination d_synoservice { file("/var/log/synoservice.log"); }; log { source(src); filter(f_synoservice); destination(d_synoservice); };