filter f_cache_protection {
    match("Cache Protection:" value("MESSAGE"));
};

rewrite r_rewrite_cache_protection {
    subst("Cache Protection:", "");
};

destination d_cache_protection { file("/var/log/cache_protection.log"); };
log { source(src); filter(f_cache_protection); rewrite(r_rewrite_cache_protection); destination(d_cache_protection); };