syslog over tcp and define management IP as source

Greifensteiner​, In include statement you actually adding pure syslog-ng configuration, not tmos directives/commands.

 In syslog-ng configuration "destination remote-server ...." is only a definition of log destination that has to be connected to some log source.

You can do it with log and filter statement.

Example that sends part (match(\": 0199\") of APM (facility(local1)) logs to 192.168.100.1:514:

include "

filter filter_logs { facility(local1);match(\": 0199\");};

destination destiantion_logs { tcp(\"192.168.100.1\" port (514) localip(\"192.168.100.2\"));};

log {

   source(s_syslog_pipe);

   filter(filter_logs);

   destination(destiantion_logs);

};

"