fluentd.conf

<source>
  @type syslog
  port 5140
  bind 0.0.0.0
  protocol_type udp
  tag syslog
</source>
<filter syslog.**>
  @type grep
  <exclude>
    key message
    pattern ldapd
  </exclude>
</filter>
<match syslog.**>
  @type route
  remove_tag_prefix syslog
  <route **>
    add_tag_prefix coloNetwork
    copy
  </route>
  <route **>
    add_tag_prefix ucslog
    copy
  </route>
  </match>
<filter coloNetwork.**>
  @type grep
  <exclude>
    key message
    pattern /%UCSM-\d-([A-Z_]+)/
  </exclude>
</filter>
<match coloNetwork.**>
  @type stdout
</match>
<match ucslog.**>
  @type file
  path /var/log/test_syslog/file1.txt
</match>