filter f_systemd_stdout { "${.SDATA.journald._TRANSPORT}" eq "stdout" };
destination d_systemd_stdout { file("/var/log/systemd/${.SDATA.journald._SYSTEMD_UNIT}.log"); };
log { source(src); filter(f_systemd_stdout); destination(d_systemd_stdout); };