Something

log server:

source src {
        internal();
        unix-dgram("/dev/log");
        udp(ip("0.0.0.0") port(514));
};

filter f_apache { level(local1); };
destination d_apache { file("/var/log/apache2/remote-access.log"); };
log { source(src); filter(f_apache); destination(d_apache); };



web servers:

filter f_apache { facility(local1); };
destination fwd_apache { udp("automatic" port(514)); };
log { source(src); filter(f_apache); destination(fwd_apache); };