Perhaps there's a better way, but...
You could give your log server multiple ip addresses, and then bind
your sources explicitly:
source s_1 {
udp( ip(192.168.1.20) flags(no_parse) );
}
source s_2 {
udp( ip(192.168.1.21) );
};
Then configure a different syslog server address into each device
depending on whether you want to run the logs through the parser or
not.
Good idea but I can't add another IP address...
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html
Thank you for the documentation !
Regards,
Yann I.