No, this is *not* what syslog-ng does. Syslog-ng does *not* pass the macro value for $S_DAY do the command line, and thus the 30 does *not* appear at all.
Yes, you are right--I thought it would but it doesn't. I still don't understand why you would need to do that. You want to send a log to a given program depending on the value of $S_DAY?
You have identified exactly what I am talking about. Syslog-ng has done the receiving, and the parsing, and then needs to forward the message to an appropriate program destination based on the parsed information.
Then use a filter(). If your setup is so specific that filter() isn't enough, then use something like Perl to route those messages. That's advanced decision making and should be done in a program. I'd rather see the Balabit guys focusing their efforts on other features.