$IncludeConfig diag-common.conf template(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n") } if $msg contains 'msgnum' then { set $!usr!msgnum = field($msg, 58, 2); if $!usr!msgnum <= "00005000" then action(type="omfile" file="./rsyslog.out.log" template="outfmt") }