destination ssh { file("/var/log/ssh.log"); pipe("/dev/xconsole"); };
filter f_ssh { program("sshd"); };
log { source(src); filter(f_ssh); destination(ssh); };