filter f_rsync_error { program(rsync) and level(warn);};
destination d_rsync { file("/var/log/rsync.error"); };
log { source(src); filter(f_rsync_error); destination(d_rsync);};