rsyslog logging based on sending host behind NAT

I have multiple Juniper devices behind one NAT’d IP sending their logs to a single host. On the wire the message looks like this: Dec 4 07:38:31 tor-29-1: dot1xd[1585]: task_connect: task PNACAUTH./var/run/authd_control addr /var/run/authd_control: Connection refused I have tried: if $programname == ‘tor-29-1’ then /var/log/juniper/tor-29-1.log & ~ And that wont work. I also tried: if…