$IncludeConfig diag-common.conf template(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n") } if $msg contains 'msgnum' then { set $!usr!msgnum = field($msg, 58, 2); if $!usr!msgnum != "00005000" and $!usr!msgnum != "00005001" and $!usr!msgnum != "00005002" then set $!usr!write = 0; else set $!usr!write = 1; if $!usr!write == 1 then action(type="omfile" file="./rsyslog.out.log" template="outfmt") }