irule to filter out all local0

Thanks for your response; just to clarify; From the F5, send all syslog messages in CEF, except local0, to log server1 and log server2, plus, send all syslog messages in native syslog to log server3.

So, I have the second part working fine; all syslog messages are being sent natively to log server3, what I now need is everying except local0 sent to log server1 and log server2 in CEF format, so I have this rule;

when CLIENT_ACCEPTED { HSL::not send [HSL::open -proto UDP -pool ] "<135> iRule c-ip=[IP::client_addr] }

Also, what's the best way to have the syslog generated messages sent in CEF format?

Many thanks