Hi,
You can find a working example for this in the default openSUSE syslog-ng configuration. See:
https://build.opensuse.org/projects/home:czanik:syslog-ng-githead/packages/syslog-ng/files/syslog-ng.conf.default?expand=1
Peter
Peter Czanik (CzP) <peter.czanik@oneidentity.com>
Balabit (a OneIdentity company) / syslog-ng upstream
https://syslog-ng.com/
community/
https://twitter.com/PCzanik