i needed to forward logs only if the log contained a certain keyword. I achieve this by adding this line in rsyslog.conf.
:msg, !contains, "xyz" ~
I know this condition means that if log contains anything other then "xyz" don't forward it but what it also does is totally discard the log and not even print it in local syslog. Can someone please provide me with a simple syntax which writes log for all situations but forwards it only for certain keywords. I'll be really grateful.