GTM Log Filters

I'm trying to create syslog filters on GTM's and seeing some issues. Configured local2 facility and match on AUDIT key however the logs on not being received by remote server. But when I just configure a remote syslog server I see them.

Any thoughts would be helpful?