or alternatively you could send .SDATA.syslog.TAGS and use a regex match on that macro on the receiver