Configuring Syslog Server for a Specific Virtual Server

one more option is to use HSL irule for this , create pool name POOL_SYSLOG

refer below

POOL_SYSLOG-create a pool with syslog server ip address

    when HTTP_REQUEST {

set http_request_time [clock clicks -milliseconds]
set timestamp [clock format [clock seconds] -format {%d/%b/%Y:%H:%M:%S %z}] 
set remote [IP::remote_addr]
set client [IP::client_addr]:[TCP::client_port]
set url [HTTP::host][HTTP::uri]
set referer [HTTP::header "Referer"]
set vip [IP::local_addr]:[TCP::local_port]
set httpMethod [HTTP::method]
set httpVersion [HTTP::version]
set xforwardfor [HTTP::header X-Forwarded-For]
set url [string map " x" $url]
set referer [string map " x" $referer] 
set hsl [HSL::open -proto UDP -pool POOL_SYSLOG]

 Limit the url variable to 300 characters
if {[string length $url] > 300} {
  set url "[string range $url 0 300]..."   
}

 Limit the referer variable to 300 characters
if {[string length $referer] > 300} {
  set referer "[string range $referer 0 300]..."   
}

 Build the Request log line
set request_log_line " $timestamp  [virtual name]  $client  $remote  $vip  $url  $referer  $httpMethod  $httpVersion" 
log local0.info "Request - $request_log_line"
}

when HTTP_RESPONSE {

 VARIABLES
 Initialize local variables used in this rule

set http_response_time [ clock clicks -milliseconds ]
set client [IP::client_addr]:[TCP::client_port]
set node [IP::server_addr]:[TCP::server_port]
set nodeResp [HTTP::status]
set payloadLength [HTTP::payload length]
set responseTime [expr $http_response_time - $http_request_time]

  Build the Response log line
 set response_log_line "$client  $node  $nodeResp  $payloadLength  $responseTime  $http_request_time  $xforwardfor" 
log local0.info "Response - $response_log_line"

 Write Request and Response log lines to the LTM log
HSL::send $hsl "IRULE_COMMON_LOG : $request_log_line  -  $response_log_line"
 }
}

It's all about the default syslog message format as it turns out.

Here's what worked for me:

• Request Logging Template = $DATE_MON $DATE_DD $TIME_HMS slot1/NNORM3-LB002V01 notice msg[HTTP-REQ-LOG] src-ip=$CLIENT_IP method=$HTTP_METHOD uri=$HTTP_URI* everything that is not preceded by $ (text in bold) is just simple text i entered that appears "as is" in logs
• syslog-ng filter = host("NNORM3-LB002V01" ) and match("HTTP-REQ-LOG" value("MESSAGE"))
• log message example = Jun 29 01:28:27 slot1/NNORM3-LB002V01 notice msg[HTTP-REQ-LOG] src-ip=10.250.158.188 method=GET uri=/dsa-claims

Inspired by: https://syslog-ng.com/documents/html/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/configuring-macros.html

Enjoy